Source: svchost.exe, 00000006.00000002.3719124683.00000157D5718000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3718853152.00000157D4E87000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.6.dr | String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd |
Source: svchost.exe, 00000002.00000002.1413554942.0000022EE5C13000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://www.bingmapsportal.com |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1419687822.0000022EE5C59000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/ |
Source: svchost.exe, 00000002.00000003.1366025641.0000022EE5C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1416429792.0000022EE5C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1374550345.0000022EE5C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1425656926.0000022EE5C70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1422519922.0000022EE5C63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1371558076.0000022EE5C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365997299.0000022EE5C6D000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/ |
Source: svchost.exe, 00000002.00000002.1425656926.0000022EE5C70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365997299.0000022EE5C6D000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/ |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations |
Source: svchost.exe, 00000002.00000002.1423303079.0000022EE5C68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366013522.0000022EE5C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1377212073.0000022EE5C6A000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/ |
Source: svchost.exe, 00000002.00000002.1425656926.0000022EE5C70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365997299.0000022EE5C6D000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/ |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx |
Source: svchost.exe, 00000002.00000003.1366025641.0000022EE5C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1415329851.0000022EE5C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1371558076.0000022EE5C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1378615730.0000022EE5C66000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/ |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations |
Source: svchost.exe, 00000002.00000002.1423303079.0000022EE5C68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1415329851.0000022EE5C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366013522.0000022EE5C67000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/ |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking |
Source: svchost.exe, 00000002.00000003.1366025641.0000022EE5C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1415329851.0000022EE5C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1378615730.0000022EE5C66000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/ |
Source: svchost.exe, 00000002.00000002.1416429792.0000022EE5C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1374550345.0000022EE5C41000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/ |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx |
Source: svchost.exe, 00000002.00000003.1366025641.0000022EE5C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1416429792.0000022EE5C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1374550345.0000022EE5C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1422519922.0000022EE5C63000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log? |
Source: svchost.exe, 00000002.00000002.1416429792.0000022EE5C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1374550345.0000022EE5C41000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.api.tilep |
Source: svchost.exe, 00000002.00000003.1373180241.0000022EE5C47000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r= |
Source: svchost.exe, 00000002.00000003.1374550345.0000022EE5C41000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r= |
Source: svchost.exe, 00000002.00000003.1366025641.0000022EE5C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1422519922.0000022EE5C63000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r= |
Source: svchost.exe, 00000002.00000002.1416429792.0000022EE5C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1374550345.0000022EE5C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366059088.0000022EE5C5E000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r= |
Source: svchost.exe, 00000002.00000003.1365997299.0000022EE5C6D000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.t |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx |
Source: svchost.exe, 00000002.00000003.1265356760.0000022EE5C36000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/ |
Source: svchost.exe, 00000002.00000002.1415329851.0000022EE5C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366013522.0000022EE5C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1377212073.0000022EE5C6A000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/ |
Source: svchost.exe, 00000002.00000003.1374550345.0000022EE5C41000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx |
Source: svchost.exe, 00000002.00000003.1373180241.0000022EE5C47000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r= |
Source: svchost.exe, 00000002.00000003.1373180241.0000022EE5C47000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r= |
Source: svchost.exe, 00000002.00000002.1415329851.0000022EE5C2B000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r= |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen |
Source: svchost.exe, 00000002.00000003.1366081893.0000022EE5C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1419687822.0000022EE5C59000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north= |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: dhcpcsvc6.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: dhcpcsvc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: napinsp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: pnrpnsp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: wshbth.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: nlaapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: winrnr.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: explorerframe.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: rasadhlp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\KVAoyRsrZC.exe | Section loaded: fwpuclnt.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: moshost.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: mapsbtsvc.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: mosstorage.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: ztrace_maps.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: ztrace_maps.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: ztrace_maps.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: mapconfiguration.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: aphostservice.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: networkhelper.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: userdataplatformhelperutil.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: syncutil.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: mccspal.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: vaultcli.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: dmcfgutils.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: msvcp110_win.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: dmcmnutils.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: dmxmlhelputils.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: policymanager.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: xmllite.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: inproclogger.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: flightsettings.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: windows.networking.connectivity.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: npmproxy.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: msv1_0.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: ntlmshared.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: cryptdll.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: synccontroller.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: pimstore.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: aphostclient.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: accountaccessor.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: dsclient.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: systemeventsusererclient.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: userdatalanguageutil.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: mccsengineshared.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: pimstore.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: cemapi.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: userdatatypehelperutil.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: phoneutil.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: execmodelproxy.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: rmclient.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: storsvc.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: devobj.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: fltlib.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: bcd.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: wer.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: cabinet.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: appxdeploymentclient.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: storageusage.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: licensemanagersvc.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: licensemanager.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: clipc.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\svchost.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: mpclient.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: secur32.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: wscapi.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Program Files\Windows Defender\MpCmdRun.exe | Section loaded: sppc.dll | Jump to behavior |
Source: svchost.exe, 00000005.00000002.3718341423.000001879E84B000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: svchost.exe, 00000005.00000002.3718814320.000001879E87E000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: svchost.exe, 00000005.00000002.3718814320.000001879E864000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000es |
Source: svchost.exe, 00000005.00000002.3718341423.000001879E84B000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D: |
Source: KVAoyRsrZC.exe, 00000000.00000002.3718142847.0000020002638000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V RAW |
Source: svchost.exe, 00000005.00000002.3718074296.000001879E82B000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ |
Source: svchost.exe, 00000005.00000002.3717763998.000001879E802000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc |
Source: svchost.exe, 00000005.00000002.3718976583.000001879E902000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: KVAoyRsrZC.exe, 00000000.00000002.3718142847.0000020002638000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V RAWB~z1 |
Source: svchost.exe, 00000005.00000002.3718341423.000001879E84B000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |