Source: msiexec.exe, 00000004.00000002.2931722428.0000000020F01000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://aborters.duckdns.org:8081 |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020F01000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://anotherarmy.dns.army:8081 |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020F01000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.org |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020F01000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.org/ |
Source: powershell.exe, 00000001.00000002.1906039371.0000000006EA1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1906039371.0000000006F03000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.micro |
Source: FACTURA DE PAGO.exe, FACTURA DE PAGO.exe.1.dr |
String found in binary or memory: http://nsis.sf.net/NSIS_Error |
Source: FACTURA DE PAGO.exe, FACTURA DE PAGO.exe.1.dr |
String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: powershell.exe, 00000001.00000002.1899557466.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://nuget.org/NuGet.exe |
Source: powershell.exe, 00000001.00000002.1896848086.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://pesterbdd.com/images/Pester.png |
Source: powershell.exe, 00000001.00000002.1896848086.0000000004A51000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2931722428.0000000020F01000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020F01000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://varders.kozow.com:8081 |
Source: powershell.exe, 00000001.00000002.1896848086.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
Source: powershell.exe, 00000001.00000002.1896848086.0000000004A51000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore6lB |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020FE7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020FE7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020FE7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text= |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020FE7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20a |
Source: msiexec.exe, 00000004.00000003.1984367070.000000000540F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://apis.google.com |
Source: msiexec.exe, 00000004.00000002.2931722428.00000000210C3000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://chrome.google.com/webstore?hl=en |
Source: msiexec.exe, 00000004.00000002.2931722428.00000000210BE000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://chrome.google.com/webstore?hl=enlB |
Source: powershell.exe, 00000001.00000002.1899557466.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/ |
Source: powershell.exe, 00000001.00000002.1899557466.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/Icon |
Source: powershell.exe, 00000001.00000002.1899557466.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/License |
Source: msiexec.exe, 00000004.00000002.2920754309.000000000539A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://drive.google.com/ |
Source: msiexec.exe, 00000004.00000002.2920754309.000000000539A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://drive.google.com/K |
Source: msiexec.exe, 00000004.00000002.2920754309.000000000539A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2931153169.0000000020570000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://drive.google.com/uc?export=download&id=1ZEribp6UWsv7328G3wN4qTd_6APeaRh2 |
Source: msiexec.exe, 00000004.00000002.2920754309.000000000539A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://drive.google.com/uc?export=download&id=1ZEribp6UWsv7328G3wN4qTd_6APeaRh2Y |
Source: msiexec.exe, 00000004.00000002.2920754309.000000000540A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2034849572.000000000540A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://drive.usercontent.google.com/ |
Source: msiexec.exe, 00000004.00000002.2920754309.00000000053F8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.1984367070.000000000540F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://drive.usercontent.google.com/download?id=1ZEribp6UWsv7328G3wN4qTd_6APeaRh2&export=download |
Source: msiexec.exe, 00000004.00000002.2920754309.000000000540A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2034849572.000000000540A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://drive.usercontent.google.com/j$v |
Source: powershell.exe, 00000001.00000002.1896848086.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/Pester/Pester |
Source: powershell.exe, 00000001.00000002.1899557466.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://nuget.org/nuget.exe |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020F50000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2931722428.0000000020FE7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020F50000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org/xml/ |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020FE7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.186 |
Source: msiexec.exe, 00000004.00000002.2931722428.0000000020FBF000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2931722428.0000000020F7A000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2931722428.0000000020FE7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.186$ |
Source: msiexec.exe, 00000004.00000003.1984367070.000000000540F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ssl.gstatic.com |
Source: msiexec.exe, 00000004.00000002.2932772711.0000000022182000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2931722428.000000002100A000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000022053000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.00000000221D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.00000000222A5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000021FDE000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.000000002202C000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 |
Source: msiexec.exe, 00000004.00000002.2932772711.0000000021FE4000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000022280000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000021FB9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000022188000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.000000002202E000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.000000002215D000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples |
Source: msiexec.exe, 00000004.00000002.2932772711.0000000022182000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2931722428.000000002100A000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000022053000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.00000000221D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.00000000222A5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000021FDE000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.000000002202C000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 |
Source: msiexec.exe, 00000004.00000002.2932772711.0000000021FE4000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000022280000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000021FB9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.0000000022188000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.000000002202E000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.2932772711.000000002215D000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install |
Source: msiexec.exe, 00000004.00000003.1984367070.000000000540F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.google-analytics.com;report-uri |
Source: msiexec.exe, 00000004.00000003.1984367070.000000000540F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.google.com |
Source: msiexec.exe, 00000004.00000003.1984367070.000000000540F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.googletagmanager.com |
Source: msiexec.exe, 00000004.00000003.1984367070.000000000540F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.gstatic.com |
Source: msiexec.exe, 00000004.00000002.2931722428.00000000210F4000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://www.office.com/ |
Source: msiexec.exe, 00000004.00000002.2931722428.00000000210EF000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://www.office.com/lB |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: oleacc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: shfolder.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: riched20.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: usp10.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: msls31.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: textinputframework.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: coreuicomponents.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Section loaded: textshaping.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: microsoft.management.infrastructure.native.unmanaged.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wmidcom.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: aclayers.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: sfc.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: sfc_os.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: rasapi32.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: rasman.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: rtutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\FACTURA DE PAGO.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 600000 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599885 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599766 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599641 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599531 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599422 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599313 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599188 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599063 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598938 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 593954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7612 |
Thread sleep time: -1844674407370954s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep count: 35 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -32281802128991695s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -600000s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8028 |
Thread sleep count: 939 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -599885s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8028 |
Thread sleep count: 8870 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -599766s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep count: 42 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -599641s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -599531s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -599422s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -599313s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -599188s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -599063s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -598938s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -598829s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -598704s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -598579s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -598454s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -598329s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -598204s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -598079s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -597954s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -597829s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -597704s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -597579s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -597454s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -597329s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -597204s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -597079s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -596954s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -596829s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -596704s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -596579s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -596454s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -596329s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -596204s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -596079s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -595954s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -595829s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -595704s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -595579s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -595454s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -595329s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -595204s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -595079s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -594954s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -594829s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -594704s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -594579s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -594454s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -594329s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -594204s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -594079s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8020 |
Thread sleep time: -593954s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 600000 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599885 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599766 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599641 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599531 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599422 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599313 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599188 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 599063 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598938 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 598079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 597079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 596079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 595079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594829 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594704 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594579 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594454 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594329 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594204 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 594079 |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Thread delayed: delay time: 593954 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\msiexec.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |