Source: | Binary string: System.Configuration.Install.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Data.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.DirectoryServices.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.Install.ni.pdbRSDSQ source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Xml.ni.pdbRSDS# source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Core.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Numerics.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.DirectoryServices.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.Management.Infrastructure.pdb` source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.ni.pdbRSDSJ< source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdbRSDS[q source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: mscorlib.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.Install.pdb) source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.Install.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Xml.pdbP4 source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.Management.Infrastructure.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.ni.pdbRSDScUN source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.Automation.pdb` source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Security.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Security.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Xml.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.pdb` source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.DirectoryServices.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.ConsoleHost.pdb6%``%` source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Data.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Data.ni.pdbRSDSC source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Xml.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.ConsoleHost.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.Automation.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Numerics.ni.pdbRSDSautg source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.Automation.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Data.pdbH source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.Automation.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: mscorlib.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Security.ni.pdbRSDS~ source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.Management.Infrastructure.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Core.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Transactions.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.Management.Infrastructure.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Transactions.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Transactions.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Numerics.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Core.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: powershell.exe, 00000000.00000002.1594442476.000001E767044000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://crl.micro |
Source: powershell.exe, 00000000.00000002.1573471547.000001E75034E000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://mayanboats.com |
Source: powershell.exe, 00000000.00000002.1588967177.000001E75ED21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1573471547.000001E75065E000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://nuget.org/NuGet.exe |
Source: powershell.exe, 00000000.00000002.1573471547.000001E7505D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1573471547.000001E7503EA000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://pesterbdd.com/images/Pester.png |
Source: powershell.exe, 00000000.00000002.1573471547.000001E74ECB1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: Amcache.hve.5.dr | String found in binary or memory: http://upx.sf.net |
Source: powershell.exe, 00000000.00000002.1573471547.000001E7503EA000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 |
Source: powershell.exe, 00000000.00000002.1573471547.000001E7505D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1573471547.000001E7503EA000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
Source: powershell.exe, 00000000.00000002.1573471547.000001E74ECB1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://aka.ms/pscore68 |
Source: powershell.exe, 00000000.00000002.1573471547.000001E75065E000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/ |
Source: powershell.exe, 00000000.00000002.1573471547.000001E75065E000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/Icon |
Source: powershell.exe, 00000000.00000002.1573471547.000001E75065E000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/License |
Source: powershell.exe, 00000000.00000002.1573471547.000001E7505D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1573471547.000001E7503EA000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://github.com/Pester/Pester |
Source: powershell.exe, 00000000.00000002.1573471547.000001E750602000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://github.com/Pester/Pesterp |
Source: powershell.exe, 00000000.00000002.1573471547.000001E74FED2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://go.micro |
Source: powershell.exe, 00000000.00000002.1573471547.000001E74EED7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1573471547.000001E7500B7000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://mayanboats.com |
Source: powershell.exe, 00000000.00000002.1573471547.000001E7500B7000.00000004.00000800.00020000.00000000.sdmp, agent3.ps1 | String found in binary or memory: https://mayanboats.com/wp-content/uploads/helper2.exe |
Source: powershell.exe, 00000000.00000002.1588967177.000001E75ED21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1573471547.000001E75065E000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://nuget.org/nuget.exe |
Source: powershell.exe, 00000000.00000002.1573471547.000001E7503EA000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://oneget.org |
Source: powershell.exe, 00000000.00000002.1573471547.000001E7503EA000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://oneget.orgX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: atl.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: mscoree.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: linkinfo.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ntshrui.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: cscapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: policymanager.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: msvcp110_win.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: taskflowdataengine.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: cdp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: dsreg.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: vcruntime140_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ucrtbase_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ucrtbase_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: msisip.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wshext.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: appxsip.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: opcservices.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: secur32.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: dhcpcsvc6.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: dhcpcsvc.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: winnsi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: rasapi32.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: rasman.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: rtutils.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ondemandconnroutehelper.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: rasadhlp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: fwpuclnt.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: schannel.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: mskeyprotect.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ncryptsslp.dll | Jump to behavior |
Source: | Binary string: System.Configuration.Install.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Data.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.DirectoryServices.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.Install.ni.pdbRSDSQ source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Xml.ni.pdbRSDS# source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Core.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Numerics.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.DirectoryServices.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.Management.Infrastructure.pdb` source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.ni.pdbRSDSJ< source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdbRSDS[q source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: mscorlib.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.Install.pdb) source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.Install.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Xml.pdbP4 source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.Management.Infrastructure.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.ni.pdbRSDScUN source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.Automation.pdb` source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Security.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Security.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Xml.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.pdb` source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.DirectoryServices.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.ConsoleHost.pdb6%``%` source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Configuration.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Data.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Data.ni.pdbRSDSC source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Xml.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.ConsoleHost.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.Automation.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Numerics.ni.pdbRSDSautg source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.Automation.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Data.pdbH source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.Automation.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: mscorlib.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.Security.ni.pdbRSDS~ source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.Management.Infrastructure.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Management.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Core.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Transactions.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.Management.Infrastructure.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Transactions.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Transactions.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Numerics.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.ni.pdb source: WERF78C.tmp.dmp.5.dr |
Source: | Binary string: System.Core.ni.pdbRSDS source: WERF78C.tmp.dmp.5.dr |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |