Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: regsvr32.exe, 00000004.00000002.3418346673.0000000002350000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabG5 |
Source: regsvr32.exe, 00000004.00000002.3418346673.0000000002350000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enen=b03f5f7& |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://nuget.org/NuGet.exe |
Source: powershell.exe, 00000002.00000002.2309860244.0000020BAA2B7000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://osoft.co |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://pesterbdd.com/images/Pester.png |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/ |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91BB1000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.0000000002742000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.00000000026C1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/wsdl/ |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
Source: powershell.exe, 00000002.00000002.2311324939.0000020BAA37E000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://www.microsoft. |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91BB1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://aka.ms/pscore68 |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://aka.ms/winsvr-2022-pshelp |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/ |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/Icon |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/License |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://github.com/Pester/Pester |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://nuget.org/nuget.exe |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF44F70 | 0_2_00007FF70BF44F70 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF44FE2 | 0_2_00007FF70BF44FE2 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF81C00 | 0_2_00007FF70BF81C00 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF88550 | 0_2_00007FF70BF88550 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF818D9 | 0_2_00007FF70BF818D9 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF464CC | 0_2_00007FF70BF464CC |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF5ED20 | 0_2_00007FF70BF5ED20 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF73D80 | 0_2_00007FF70BF73D80 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF5DDC0 | 0_2_00007FF70BF5DDC0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4BE10 | 0_2_00007FF70BF4BE10 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF50E10 | 0_2_00007FF70BF50E10 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF41E50 | 0_2_00007FF70BF41E50 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF69E80 | 0_2_00007FF70BF69E80 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4EF8C | 0_2_00007FF70BF4EF8C |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF79F90 | 0_2_00007FF70BF79F90 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4EFFB | 0_2_00007FF70BF4EFFB |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF88000 | 0_2_00007FF70BF88000 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF89040 | 0_2_00007FF70BF89040 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF52045 | 0_2_00007FF70BF52045 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF8C060 | 0_2_00007FF70BF8C060 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF77060 | 0_2_00007FF70BF77060 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F06B | 0_2_00007FF70BF4F06B |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF6A06A | 0_2_00007FF70BF6A06A |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF87090 | 0_2_00007FF70BF87090 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4A950 | 0_2_00007FF70BF4A950 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F9A5 | 0_2_00007FF70BF4F9A5 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF729B0 | 0_2_00007FF70BF729B0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF459C2 | 0_2_00007FF70BF459C2 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF489F0 | 0_2_00007FF70BF489F0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF69A10 | 0_2_00007FF70BF69A10 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4FA24 | 0_2_00007FF70BF4FA24 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF46A45 | 0_2_00007FF70BF46A45 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF64A70 | 0_2_00007FF70BF64A70 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF5BAC0 | 0_2_00007FF70BF5BAC0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF6DAD0 | 0_2_00007FF70BF6DAD0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4EB70 | 0_2_00007FF70BF4EB70 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF5FB80 | 0_2_00007FF70BF5FB80 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4EC30 | 0_2_00007FF70BF4EC30 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4FC94 | 0_2_00007FF70BF4FC94 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4CCD0 | 0_2_00007FF70BF4CCD0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF45526 | 0_2_00007FF70BF45526 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F583 | 0_2_00007FF70BF4F583 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F5A6 | 0_2_00007FF70BF4F5A6 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF6C5B0 | 0_2_00007FF70BF6C5B0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F5F5 | 0_2_00007FF70BF4F5F5 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF6A60F | 0_2_00007FF70BF6A60F |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4663B | 0_2_00007FF70BF4663B |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF45646 | 0_2_00007FF70BF45646 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF8F660 | 0_2_00007FF70BF8F660 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF73660 | 0_2_00007FF70BF73660 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF8F680 | 0_2_00007FF70BF8F680 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F69D | 0_2_00007FF70BF4F69D |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF466A5 | 0_2_00007FF70BF466A5 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF7A700 | 0_2_00007FF70BF7A700 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF77750 | 0_2_00007FF70BF77750 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4B760 | 0_2_00007FF70BF4B760 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F7AB | 0_2_00007FF70BF4F7AB |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F816 | 0_2_00007FF70BF4F816 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF87819 | 0_2_00007FF70BF87819 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF75850 | 0_2_00007FF70BF75850 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4C880 | 0_2_00007FF70BF4C880 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF81900 | 0_2_00007FF70BF81900 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF53120 | 0_2_00007FF70BF53120 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F166 | 0_2_00007FF70BF4F166 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF75160 | 0_2_00007FF70BF75160 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF8E1C0 | 0_2_00007FF70BF8E1C0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF7B1D0 | 0_2_00007FF70BF7B1D0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF441F8 | 0_2_00007FF70BF441F8 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF43200 | 0_2_00007FF70BF43200 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF87240 | 0_2_00007FF70BF87240 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF72260 | 0_2_00007FF70BF72260 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF46270 | 0_2_00007FF70BF46270 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF452E6 | 0_2_00007FF70BF452E6 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF6A2E7 | 0_2_00007FF70BF6A2E7 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F37A | 0_2_00007FF70BF4F37A |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF5E3B0 | 0_2_00007FF70BF5E3B0 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF45406 | 0_2_00007FF70BF45406 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF6A419 | 0_2_00007FF70BF6A419 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF70420 | 0_2_00007FF70BF70420 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF7C430 | 0_2_00007FF70BF7C430 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF64470 | 0_2_00007FF70BF64470 |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F47C | 0_2_00007FF70BF4F47C |
Source: C:\Users\user\Desktop\g3y89237.exe | Code function: 0_2_00007FF70BF4F4E9 | 0_2_00007FF70BF4F4E9 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD34784DFA | 2_2_00007FFD34784DFA |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD3478B9F2 | 2_2_00007FFD3478B9F2 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD3478264D | 2_2_00007FFD3478264D |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD34788D70 | 2_2_00007FFD34788D70 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD3478BAFA | 2_2_00007FFD3478BAFA |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD3478B300 | 2_2_00007FFD3478B300 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD34784270 | 2_2_00007FFD34784270 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD34788AB5 | 2_2_00007FFD34788AB5 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD34783812 | 2_2_00007FFD34783812 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 2_2_00007FFD34853C21 | 2_2_00007FFD34853C21 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B36493C | 4_2_00007FFD8B36493C |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B3627CB | 4_2_00007FFD8B3627CB |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B36358F | 4_2_00007FFD8B36358F |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B377C20 | 4_2_00007FFD8B377C20 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B37DAB0 | 4_2_00007FFD8B37DAB0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B38BB20 | 4_2_00007FFD8B38BB20 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B36EB10 | 4_2_00007FFD8B36EB10 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B361B17 | 4_2_00007FFD8B361B17 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B38E8E0 | 4_2_00007FFD8B38E8E0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B385910 | 4_2_00007FFD8B385910 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B398050 | 4_2_00007FFD8B398050 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B378010 | 4_2_00007FFD8B378010 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B38CEB0 | 4_2_00007FFD8B38CEB0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B36AED0 | 4_2_00007FFD8B36AED0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B392ED0 | 4_2_00007FFD8B392ED0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B382E90 | 4_2_00007FFD8B382E90 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B367E50 | 4_2_00007FFD8B367E50 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B36237F | 4_2_00007FFD8B36237F |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B38B400 | 4_2_00007FFD8B38B400 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B3832F0 | 4_2_00007FFD8B3832F0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B379310 | 4_2_00007FFD8B379310 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B3771A4 | 4_2_00007FFD8B3771A4 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B38E210 | 4_2_00007FFD8B38E210 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B37E0B0 | 4_2_00007FFD8B37E0B0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B3940D0 | 4_2_00007FFD8B3940D0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B39F060 | 4_2_00007FFD8B39F060 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B390090 | 4_2_00007FFD8B390090 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B36A120 | 4_2_00007FFD8B36A120 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B38C7D0 | 4_2_00007FFD8B38C7D0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B390760 | 4_2_00007FFD8B390760 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B36182A | 4_2_00007FFD8B36182A |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B3896F0 | 4_2_00007FFD8B3896F0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B393620 | 4_2_00007FFD8B393620 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B3735F0 | 4_2_00007FFD8B3735F0 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD8B396540 | 4_2_00007FFD8B396540 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_02416A1C | 4_2_02416A1C |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_02416DF8 | 4_2_02416DF8 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_02417228 | 4_2_02417228 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_0241A4D4 | 4_2_0241A4D4 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_02415B40 | 4_2_02415B40 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_02417CDC | 4_2_02417CDC |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD347914A8 | 4_2_00007FFD347914A8 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD34795F45 | 4_2_00007FFD34795F45 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD347A0E66 | 4_2_00007FFD347A0E66 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD3479719E | 4_2_00007FFD3479719E |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD347A1C12 | 4_2_00007FFD347A1C12 |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD3479CDCD | 4_2_00007FFD3479CDCD |
Source: C:\Windows\System32\regsvr32.exe | Code function: 4_2_00007FFD34797362 | 4_2_00007FFD34797362 |
Source: 4.2.regsvr32.exe.23d130d.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 4.2.regsvr32.exe.668bfd.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 4.2.regsvr32.exe.23d130d.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 4.2.regsvr32.exe.668bfd.0.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 00000004.00000002.3418525753.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 00000004.00000002.3417790081.000000000064B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: C:\Users\user\Desktop\g3y89237.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\Desktop\g3y89237.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\g3y89237.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\g3y89237.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: atl.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: mscoree.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: vcruntime140_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ucrtbase_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: msisip.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wshext.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: appxsip.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: opcservices.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: secur32.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: kdscli.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: microsoft.management.infrastructure.native.unmanaged.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: mi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: miutils.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wmidcom.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: dpapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: aclayers.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: sfc.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: mscoree.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: vcruntime140_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: ucrtbase_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: winnsi.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: secur32.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: schannel.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: mskeyprotect.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: ncryptsslp.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: cryptnet.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: sxs.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: devenum.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: devobj.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: msdmo.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: aclayers.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: sfc.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation | Jump to behavior |