msiexec
Named by 4 kept items in this workspace.
Search every workspace for msiexec. It matches the name as written, so it can find other things that share it.
The items that name it 4
Used to silently install the malicious MSI (/qn /norestart) launched by PowerShell.
Invoked by some scripts to install payloads hosted on attacker-controlled infrastructure
Windows installer command-line utility; used by the threat actor to silently install the Net Monitor for Employees Professional agent pulled directly from networklookout[.]com.
Windows installer utility invoked with /qn for silent installation of the downloaded Bluetrait agent setup.msi
All technologies in this workspace.