Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.1 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.15 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154. |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.1 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.17 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172. |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.1 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.16 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/ |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/p |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pc |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pcz |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/ |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/r |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/ro |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/roy |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royy |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyy |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyya |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas. |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.h |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.ht |
Source: mshta.exe, 00000003.00000002.3401055468.000001CEAC2B8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.3400850119.000001CEAC240000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.hta |
Source: mshta.exe, 00000003.00000002.3401055468.000001CEAC2D7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.hta... |
Source: mshta.exe, 00000003.00000002.3401055468.000001CEAC2D7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.hta...ory |
Source: mshta.exe, 00000003.00000002.3401055468.000001CEAC2B0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.hta3 |
Source: mshta.exe, 00000003.00000002.3401055468.000001CEAC2D7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.hta5 |
Source: mshta.exe, 00000003.00000002.3401055468.000001CEAC2B0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.htaC: |
Source: mshta.exe, 00000003.00000002.3400946587.000001CEAC260000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.htaH |
Source: mshta.exe, 00000003.00000002.3400850119.000001CEAC240000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.hta_BROWSER_AP5; |
Source: mshta.exe, 00000003.00000002.3401055468.000001CEAC2D7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://94.154.172.166/pczt/royyyas.htata |
Source: svchost.exe, 00000006.00000002.3402795586.0000017611E8D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.ver) |
Source: qmgr.db.6.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU |
Source: qmgr.db.6.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n |
Source: qmgr.db.6.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/ |
Source: qmgr.db.6.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567 |
Source: qmgr.db.6.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg |
Source: qmgr.db.6.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe |
Source: edb.log.6.dr |
String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20 |
Source: powershell.exe, 00000000.00000002.2242575824.00000256ECD87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2221482929.00000256DE57C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2242575824.00000256ECC44000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://nuget.org/NuGet.exe |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DE521000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2221482929.00000256DE2DF000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://pesterbdd.com/images/Pester.png |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DCBD1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DE2DF000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DE521000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2221482929.00000256DE2DF000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DCBD1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore68 |
Source: powershell.exe, 00000000.00000002.2242575824.00000256ECC44000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/ |
Source: powershell.exe, 00000000.00000002.2242575824.00000256ECC44000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/Icon |
Source: powershell.exe, 00000000.00000002.2242575824.00000256ECC44000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/License |
Source: edb.log.6.dr |
String found in binary or memory: https://g.live.com/odclientsettings/Prod/C: |
Source: svchost.exe, 00000006.00000003.2445301976.0000017611C80000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr |
String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C: |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DE521000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2221482929.00000256DE2DF000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/Pester/Pester |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DDAEB000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://go.micro |
Source: powershell.exe, 00000000.00000002.2247853489.00000256F4E15000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://go.micros- |
Source: mshta.exe, 00000003.00000002.3401055468.000001CEAC326000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com |
Source: powershell.exe, 00000000.00000002.2242575824.00000256ECD87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2221482929.00000256DE57C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2242575824.00000256ECC44000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://nuget.org/nuget.exe |
Source: qmgr.db.6.dr |
String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C: |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DE2DF000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://oneget.org |
Source: powershell.exe, 00000000.00000002.2221482929.00000256DE2DF000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://oneget.orgX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: linkinfo.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ntshrui.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cscapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: policymanager.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msvcp110_win.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: taskflowdataengine.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cdp.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dsreg.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: mshtml.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: wkscli.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: msiso.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: srpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: ieframe.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: netapi32.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: msimtf.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: textinputframework.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: coreuicomponents.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: dataexchange.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: dcomp.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: msls31.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: d2d1.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: qmgr.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsperf.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: firewallapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: esent.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: fwbase.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: flightsettings.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: netprofm.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: npmproxy.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsigd.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: upnp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ssdpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: appxdeploymentclient.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: wsmauto.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: wsmsvc.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dsrole.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: pcwum.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: wkscli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: msv1_0.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ntlmshared.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptdll.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: rmclient.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: usermgrcli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: execmodelclient.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: execmodelproxy.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: vssapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: vsstrace.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: samcli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: samlib.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: es.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsproxy.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |