Source: |
Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdbpte source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\dll\mscorlib.pdb source: svchost.exe, 00000009.00000002.1561024027.0000013898878000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1520877900.0000013F3D2F6000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: HC:\Windows\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Drawing.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Users\user\AppData\Roaming\svchost.PDB source: svchost.exe, 0000000C.00000002.1520877900.0000013F3D2F6000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdbh source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: symbols\dll\System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdbg source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdbRSDS7^3l source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Drawing.ni.pdbRSDS source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: !0\??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.ni.pdbRSDS# source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Core.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: Microsoft.VisualBasic.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbvider source: svchost.exe, 0000000C.00000002.1520490428.0000013F3D2B0000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\dll\mscorlib.pdb`?y source: svchost.exe, 00000009.00000002.1600531424.00000138B5200000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.pdb` source: WERF9D.tmp.dmp.32.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: svchost.exe, 0000000C.00000002.1520490428.0000013F3D2B0000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb* H source: svchost.exe, 00000009.00000002.1561362879.00000138988AC000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdbdbpdb source: svchost.exe, 0000000C.00000002.1532137769.0000013F57C73000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdb* source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.ni.pdbRSDS source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: xC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\mscorlib.pdb*k source: svchost.exe, 0000000C.00000002.1531557318.0000013F57C13000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\mscorlib.pdb source: svchost.exe, 00000009.00000002.1602148368.00000138B526F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Drawing.pdbUyJ source: WERF9D.tmp.dmp.32.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: C:\Windows\System.Windows.Forms.pdbpdbrms.pdbC:\Windows\System32\OneCoreCommonProxyStub.dll source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.ni.pdbRSDScUN source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1532137769.0000013F57C73000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: Microsoft.VisualBasic.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Xml.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: svchost.exe, 00000009.00000002.1600531424.00000138B5200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1561626202.00000138988D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.ni.pdbRSDS source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: C:\Windows\System.Windows.Forms.pdbpdbrms.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.pdbP%%=? source: WER81B.tmp.dmp.26.dr, WEREACF.tmp.dmp.21.dr |
Source: |
Binary string: System.Windows.Forms.pdb.Forms.pdbpdbrms.pdbm.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb? source: svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: 91\??\C:\Windows\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\System.Windows.Forms.pdb\??\C:\Windows\symbols\dll\mscorlib.pdbShellItem Shell Namespace helper source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Configuration.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbao source: svchost.exe, 0000000C.00000002.1532137769.0000013F57C73000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: svchost.exe, 00000009.00000002.1561626202.00000138988D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1520490428.0000013F3D2B0000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: ()\??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1602148368.00000138B526F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1520417366.0000013F3D299000.00000004.00000020.00020000.00000000.sdmp, WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: mscorlib.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Windows.Forms.pdbt source: svchost.exe, 0000000C.00000002.1520417366.0000013F3D299000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\mscorlib.pdbok source: svchost.exe, 00000009.00000002.1561626202.00000138988D7000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdbp+) source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Drawing.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Core.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdbF9E-7F9C-4437-8B11-F424491E3931}\ServerF9C-4437-8B11-F424491E3931}\InprocServer32 source: svchost.exe, 00000009.00000002.1601737927.00000138B525E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1531557318.0000013F57C6E000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.pdb0 source: WERF9D.tmp.dmp.32.dr |
Source: |
Binary string: System.Windows.Forms.pdb.Forms.pdbpdbrms.pdbm.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb8 source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdbn source: svchost.exe, 00000009.00000002.1600531424.00000138B5200000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: Microsoft.VisualBasic.pdbMZ@ source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: symbols\dll\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.pdbP source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Core.ni.pdbRSDS source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: svchost.exe, 00000016.00000003.1441392975.00000127C5102000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://Passport.NET/STS</ds:KeyName><:KeyInfo |
Source: svchost.exe, 00000016.00000003.1503199338.00000127C596B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd |
Source: svchost.exe, 00000016.00000003.3307925667.00000127C5076000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1451985460.00000127C5956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1465314672.00000127C5932000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://Passport.NET/tb |
Source: svchost.exe, 00000016.00000002.3308848752.00000127C50B5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3309635765.00000127C60E1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3309611722.00000127C60D1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://Passport.NET/tb_ |
Source: svchost.exe, 00000002.00000002.2966266630.00000250E6800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308848752.00000127C50D9000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.ver) |
Source: svchost.exe, 00000016.00000003.1451872925.00000127C5952000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200 |
Source: svchost.exe, 00000016.00000003.1479153178.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1451899387.00000127C595D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd |
Source: svchost.exe, 00000016.00000003.1493011495.00000127C5955000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd3wiK1y |
Source: svchost.exe, 00000016.00000003.3306981164.00000127C590F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307382053.00000127C590F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA |
Source: svchost.exe, 00000016.00000003.1465262209.00000127C5952000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdcurity |
Source: svchost.exe, 00000016.00000003.1464651833.00000127C5955000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdference |
Source: svchost.exe, 00000016.00000003.1492845140.00000127C592F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdp://sc |
Source: svchost.exe, 00000016.00000003.1464651833.00000127C5955000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdsyVb/vlWA |
Source: svchost.exe, 00000016.00000003.1465262209.00000127C5952000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd~ |
Source: svchost.exe, 00000016.00000003.1451565806.00000127C5956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1464651833.00000127C5955000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1451565806.00000127C5954000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1465879513.00000127C592A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1465290470.00000127C595D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1451899387.00000127C595D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd |
Source: svchost.exe, 00000016.00000003.1492845140.00000127C592F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd.0.xs |
Source: svchost.exe, 00000016.00000003.3306981164.00000127C590F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307382053.00000127C590F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA |
Source: svchost.exe, 00000016.00000003.1464651833.00000127C5955000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAAAAA |
Source: svchost.exe, 00000016.00000003.1464651833.00000127C5955000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdJjT99GvGMU |
Source: svchost.exe, 00000016.00000003.1493011495.00000127C5955000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdRYqRX |
Source: svchost.exe, 00000016.00000003.1464651833.00000127C5955000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdVyq |
Source: svchost.exe, 00000016.00000003.1451565806.00000127C5956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1451899387.00000127C595D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdecuri |
Source: svchost.exe, 00000016.00000003.1465262209.00000127C5952000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdhema |
Source: svchost.exe, 00000016.00000003.1492845140.00000127C592F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdorg |
Source: svchost.exe, 00000016.00000003.1465262209.00000127C5952000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsis-2 |
Source: svchost.exe, 00000016.00000003.1465262209.00000127C5952000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsoa |
Source: svchost.exe, 00000016.00000003.1465262209.00000127C5952000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdxml |
Source: svchost.exe, 00000016.00000003.1498513433.00000127C607D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1484910298.00000127C5952000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID |
Source: qmgr.db.2.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU |
Source: qmgr.db.2.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n |
Source: qmgr.db.2.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/ |
Source: qmgr.db.2.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567 |
Source: qmgr.db.2.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg |
Source: qmgr.db.2.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe |
Source: qmgr.db.2.dr |
String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20 |
Source: csc.exe, ngen.exe, wmplayer.exe |
String found in binary or memory: http://geoplugin.net/json.gp |
Source: svchost.exe, 00000009.00000002.1595202046.00000138AA616000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1528643546.0000013F4F016000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 0000000D.00000002.3800959907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, ngen.exe, 00000013.00000002.1399213491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.1546946748.0000020A45615000.00000004.00000800.00020000.00000000.sdmp, wmplayer.exe, 0000001D.00000002.1492594141.0000000000400000.00000040.00000400.00020000.00000000.sdmp, svchost.exe, 00000027.00000002.1623163422.000001C227275000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://geoplugin.net/json.gp/C |
Source: svchost.exe, 00000016.00000002.3309287313.00000127C605B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://passport.net/tb |
Source: svchost.exe, 00000016.00000003.1501156499.00000127C5931000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.mi |
Source: svchost.exe, 00000016.00000003.3307665855.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306823290.00000127C594A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306202897.00000127C5949000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306846415.00000127C594C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous |
Source: svchost.exe, 00000016.00000003.3306577021.00000127C593D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy |
Source: svchost.exe, 00000016.00000003.3306577021.00000127C593D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc |
Source: svchost.exe, 00000016.00000003.3306229401.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307739912.00000127C5965000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sccI=c |
Source: svchost.exe, 00000016.00000003.3306499705.00000127C593A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307643246.00000127C5943000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306420605.00000127C5937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306773985.00000127C5942000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306680570.00000127C5941000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306577021.00000127C593D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sconnce |
Source: svchost.exe, 00000016.00000003.3306577021.00000127C593D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust |
Source: svchost.exe, 00000016.00000003.1492911257.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1479614027.00000127C5953000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1465314672.00000127C592D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1488317701.00000127C5959000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1451985460.00000127C595A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1479614027.00000127C5959000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1451985460.00000127C5956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1465314672.00000127C5932000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1488411468.00000127C5955000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1479992974.00000127C5955000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1488317701.00000127C5953000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue |
Source: svchost.exe, 00000016.00000003.1492911257.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307576853.00000127C596F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1503199338.00000127C596B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuef |
Source: svchost.exe, 00000016.00000003.1492911257.00000127C596B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue |
Source: svchost.exe, 00000016.00000002.3308906391.00000127C50E6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307576853.00000127C596F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1503199338.00000127C596B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue |
Source: svchost.exe, 00000016.00000003.1492911257.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307576853.00000127C596F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1503199338.00000127C596B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue |
Source: svchost.exe, 00000016.00000003.3306499705.00000127C593A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307643246.00000127C5943000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306420605.00000127C5937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306773985.00000127C5942000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306680570.00000127C5941000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3306577021.00000127C593D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustn |
Source: LisectAVT_2403002A_136.exe, 00000000.00000002.1359537990.0000021425801000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: Amcache.hve.16.dr |
String found in binary or memory: http://upx.sf.net |
Source: svchost.exe, 00000016.00000003.1441392975.00000127C5102000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.w3.o |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502 |
Source: svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502ssuer |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421450025.00000127C5956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C592C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601 |
Source: svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421450025.00000127C5956000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603 |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605 |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600 |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601 |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603 |
Source: svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603ssuer |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604 |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420714728.00000127C5957000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://account.live.com/msangcwam |
Source: qmgr.db.2.dr |
String found in binary or memory: https://g.live.com/odclientsettings/Prod-C: |
Source: svchost.exe, 00000002.00000003.1335457695.00000250E6A00000.00000004.00000800.00020000.00000000.sdmp, edb.log.2.dr |
String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C: |
Source: svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ApproveSession.srf |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ApproveSession.srf215 |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421450025.00000127C5956000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421450025.00000127C5956000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601 |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502 |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600 |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C592C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601 |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ListSessions.srf |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ManageApprover.srf |
Source: svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ManageLoginKeys.srf |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ManageLoginKeys.srf.srf |
Source: svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3309287313.00000127C605B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/RST2.srf |
Source: svchost.exe, 00000016.00000002.3309166088.00000127C6013000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/RST2.srft |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/didtou.srf |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/getrealminfo.srf |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/getuserrealm.srf |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf |
Source: svchost.exe, 00000016.00000003.1421113174.00000127C5927000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf |
Source: svchost.exe, 00000016.00000003.1421113174.00000127C5927000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf |
Source: svchost.exe, 00000016.00000003.1421113174.00000127C5927000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf |
Source: svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C592C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421450025.00000127C5956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601 |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603 |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604 |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421043981.00000127C596B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf |
Source: svchost.exe, 00000016.00000003.1419925147.00000127C592C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm |
Source: svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin. |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502 |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=8060 |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1421450025.00000127C5956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603 |
Source: svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420714728.00000127C5957000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608 |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp |
Source: svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C592C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420014613.00000127C595A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp |
Source: svchost.exe, 00000016.00000003.1420083064.00000127C5952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C5929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605 |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf |
Source: svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1441392975.00000127C50FA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3309611722.00000127C60D1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf57 |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf |
Source: svchost.exe, 00000016.00000002.3308666709.00000127C5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srfer |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf |
Source: svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/resetpw.srf |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/resetpw.srfe |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/retention.srf |
Source: svchost.exe, 00000016.00000002.3308906391.00000127C50E6000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com:443/RST2.srf |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.comps |
Source: svchost.exe, 00000016.00000002.3309287313.00000127C6077000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.comx |
Source: svchost.exe, 00000016.00000002.3309287313.00000127C6077000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.comxr |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.m/ |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308644935.00000127C505F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf |
Source: svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfs |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf |
Source: svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.3307925667.00000127C5066000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420940557.00000127C5963000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf |
Source: svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf |
Source: svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf |
Source: svchost.exe, 00000016.00000003.1421113174.00000127C5927000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM |
Source: svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfres |
Source: svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf |
Source: svchost.exe, 00000016.00000003.1420656517.00000127C593B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308591628.00000127C502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420621700.00000127C594D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3308618491.00000127C5047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420083064.00000127C5955000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1420875086.00000127C5940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.1419925147.00000127C592C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://signup.live.com/signup.aspx |
Source: 29.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 29.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 29.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 19.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 19.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 19.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 12.2.svchost.exe.13f4f101900.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 12.2.svchost.exe.13f4f101900.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 12.2.svchost.exe.13f4f101900.1.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 39.2.svchost.exe.1c227360bd8.2.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 39.2.svchost.exe.1c227360bd8.2.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 39.2.svchost.exe.1c227360bd8.2.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 24.2.svchost.exe.20a4568b350.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 24.2.svchost.exe.20a4568b350.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 24.2.svchost.exe.20a4568b350.0.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 24.2.svchost.exe.20a45700998.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 24.2.svchost.exe.20a45700998.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 24.2.svchost.exe.20a45700998.1.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 12.2.svchost.exe.13f4f08c2b8.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 12.2.svchost.exe.13f4f08c2b8.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 12.2.svchost.exe.13f4f08c2b8.0.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 9.2.svchost.exe.138aa701bf0.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 9.2.svchost.exe.138aa701bf0.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 9.2.svchost.exe.138aa701bf0.0.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 19.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 19.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 19.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 39.2.svchost.exe.1c2272eb590.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 39.2.svchost.exe.1c2272eb590.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 39.2.svchost.exe.1c2272eb590.1.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 24.2.svchost.exe.20a45700998.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 24.2.svchost.exe.20a45700998.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 24.2.svchost.exe.20a45700998.1.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 29.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 29.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 29.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 9.2.svchost.exe.138aa68c5a8.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 9.2.svchost.exe.138aa68c5a8.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 9.2.svchost.exe.138aa68c5a8.1.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 13.2.csc.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 13.2.csc.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 13.2.csc.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 12.2.svchost.exe.13f4f101900.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 12.2.svchost.exe.13f4f101900.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 12.2.svchost.exe.13f4f101900.1.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 13.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 13.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 13.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 12.2.svchost.exe.13f4f08c2b8.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 12.2.svchost.exe.13f4f08c2b8.0.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 9.2.svchost.exe.138aa701bf0.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 9.2.svchost.exe.138aa701bf0.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 9.2.svchost.exe.138aa701bf0.0.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 24.2.svchost.exe.20a4568b350.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 24.2.svchost.exe.20a4568b350.0.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 39.2.svchost.exe.1c227360bd8.2.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 39.2.svchost.exe.1c227360bd8.2.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 9.2.svchost.exe.138aa68c5a8.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 9.2.svchost.exe.138aa68c5a8.1.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 39.2.svchost.exe.1c2272eb590.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 39.2.svchost.exe.1c2272eb590.1.raw.unpack, type: UNPACKEDPE |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 0000000C.00000002.1528643546.0000013F4F016000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000D.00000002.3800959907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000D.00000002.3800959907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0000000D.00000002.3800959907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 00000013.00000002.1399213491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000013.00000002.1399213491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 00000013.00000002.1399213491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 0000001D.00000002.1492594141.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000001D.00000002.1492594141.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0000001D.00000002.1492594141.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen |
Source: 00000009.00000002.1595202046.00000138AA616000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000018.00000002.1546946748.0000020A45615000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000027.00000002.1623163422.000001C227275000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: svchost.exe PID: 7964, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: svchost.exe PID: 8048, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: csc.exe PID: 8164, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: ngen.exe PID: 7544, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: svchost.exe PID: 1072, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: wmplayer.exe PID: 2052, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: svchost.exe PID: 7920, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B2079A |
0_2_00007FF887B2079A |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B27760 |
0_2_00007FF887B27760 |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B17F18 |
0_2_00007FF887B17F18 |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B16590 |
0_2_00007FF887B16590 |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B28B19 |
0_2_00007FF887B28B19 |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B1F329 |
0_2_00007FF887B1F329 |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B1116D |
0_2_00007FF887B1116D |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B1C900 |
0_2_00007FF887B1C900 |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B23EFA |
0_2_00007FF887B23EFA |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B17DF8 |
0_2_00007FF887B17DF8 |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Code function: 0_2_00007FF887B21C55 |
0_2_00007FF887B21C55 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B06590 |
9_2_00007FF887B06590 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B07DDD |
9_2_00007FF887B07DDD |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B0116D |
9_2_00007FF887B0116D |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B1F8EE |
9_2_00007FF887B1F8EE |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B1E079 |
9_2_00007FF887B1E079 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B1079A |
9_2_00007FF887B1079A |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B1C7B5 |
9_2_00007FF887B1C7B5 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B18B19 |
9_2_00007FF887B18B19 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B0F329 |
9_2_00007FF887B0F329 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B22699 |
9_2_00007FF887B22699 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B0B160 |
9_2_00007FF887B0B160 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B0C900 |
9_2_00007FF887B0C900 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B11C55 |
9_2_00007FF887B11C55 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 9_2_00007FF887B13EFA |
9_2_00007FF887B13EFA |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 12_2_00007FF887AF6590 |
12_2_00007FF887AF6590 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 12_2_00007FF887AF7DDD |
12_2_00007FF887AF7DDD |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 12_2_00007FF887B0079A |
12_2_00007FF887B0079A |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 12_2_00007FF887B0C7B5 |
12_2_00007FF887B0C7B5 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 12_2_00007FF887AFF329 |
12_2_00007FF887AFF329 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 12_2_00007FF887B08B19 |
12_2_00007FF887B08B19 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 12_2_00007FF887B01C55 |
12_2_00007FF887B01C55 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00425152 |
13_2_00425152 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00435286 |
13_2_00435286 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_004513D4 |
13_2_004513D4 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_0045050B |
13_2_0045050B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00436510 |
13_2_00436510 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_004316FB |
13_2_004316FB |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_0043569E |
13_2_0043569E |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00443700 |
13_2_00443700 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_004257FB |
13_2_004257FB |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_004128E3 |
13_2_004128E3 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00425964 |
13_2_00425964 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_0041B917 |
13_2_0041B917 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_0043D9CC |
13_2_0043D9CC |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00435AD3 |
13_2_00435AD3 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00424BC3 |
13_2_00424BC3 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_0043DBFB |
13_2_0043DBFB |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_0044ABA9 |
13_2_0044ABA9 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00433C0B |
13_2_00433C0B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00434D8A |
13_2_00434D8A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_0043DE2A |
13_2_0043DE2A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_0041CEAF |
13_2_0041CEAF |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Code function: 13_2_00435F08 |
13_2_00435F08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00425152 |
19_2_00425152 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00435286 |
19_2_00435286 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_004513D4 |
19_2_004513D4 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_0045050B |
19_2_0045050B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00436510 |
19_2_00436510 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_004316FB |
19_2_004316FB |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_0043569E |
19_2_0043569E |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00443700 |
19_2_00443700 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_004257FB |
19_2_004257FB |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_004128E3 |
19_2_004128E3 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00425964 |
19_2_00425964 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_0041B917 |
19_2_0041B917 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_0043D9CC |
19_2_0043D9CC |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00435AD3 |
19_2_00435AD3 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00424BC3 |
19_2_00424BC3 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_0043DBFB |
19_2_0043DBFB |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_0044ABA9 |
19_2_0044ABA9 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00433C0B |
19_2_00433C0B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00434D8A |
19_2_00434D8A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_0043DE2A |
19_2_0043DE2A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_0041CEAF |
19_2_0041CEAF |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
Code function: 19_2_00435F08 |
19_2_00435F08 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887B12694 |
24_2_00007FF887B12694 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887B0C7B5 |
24_2_00007FF887B0C7B5 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887B0E93E |
24_2_00007FF887B0E93E |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887AF116D |
24_2_00007FF887AF116D |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887AF6590 |
24_2_00007FF887AF6590 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887AF7DDD |
24_2_00007FF887AF7DDD |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887B01C55 |
24_2_00007FF887B01C55 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887B0079A |
24_2_00007FF887B0079A |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887AFF329 |
24_2_00007FF887AFF329 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887B04929 |
24_2_00007FF887B04929 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 24_2_00007FF887B08B19 |
24_2_00007FF887B08B19 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00425152 |
29_2_00425152 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00435286 |
29_2_00435286 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_004513D4 |
29_2_004513D4 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_0045050B |
29_2_0045050B |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00436510 |
29_2_00436510 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_004316FB |
29_2_004316FB |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_0043569E |
29_2_0043569E |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00443700 |
29_2_00443700 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_004257FB |
29_2_004257FB |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_004128E3 |
29_2_004128E3 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00425964 |
29_2_00425964 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_0041B917 |
29_2_0041B917 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_0043D9CC |
29_2_0043D9CC |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00435AD3 |
29_2_00435AD3 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00424BC3 |
29_2_00424BC3 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_0043DBFB |
29_2_0043DBFB |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_0044ABA9 |
29_2_0044ABA9 |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00433C0B |
29_2_00433C0B |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00434D8A |
29_2_00434D8A |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_0043DE2A |
29_2_0043DE2A |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_0041CEAF |
29_2_0041CEAF |
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe |
Code function: 29_2_00435F08 |
29_2_00435F08 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 39_2_00007FF887B2A7F2 |
39_2_00007FF887B2A7F2 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 39_2_00007FF887B3079A |
39_2_00007FF887B3079A |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 39_2_00007FF887B32345 |
39_2_00007FF887B32345 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 39_2_00007FF887B38B19 |
39_2_00007FF887B38B19 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 39_2_00007FF887B2F329 |
39_2_00007FF887B2F329 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 39_2_00007FF887B386B0 |
39_2_00007FF887B386B0 |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 39_2_00007FF887B27DDD |
39_2_00007FF887B27DDD |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Code function: 39_2_00007FF887B26590 |
39_2_00007FF887B26590 |
Source: 29.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 29.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 29.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 19.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 19.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 19.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 12.2.svchost.exe.13f4f101900.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 12.2.svchost.exe.13f4f101900.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 12.2.svchost.exe.13f4f101900.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 39.2.svchost.exe.1c227360bd8.2.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 39.2.svchost.exe.1c227360bd8.2.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 39.2.svchost.exe.1c227360bd8.2.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 24.2.svchost.exe.20a4568b350.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 24.2.svchost.exe.20a4568b350.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 24.2.svchost.exe.20a4568b350.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 24.2.svchost.exe.20a45700998.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 24.2.svchost.exe.20a45700998.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 24.2.svchost.exe.20a45700998.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 12.2.svchost.exe.13f4f08c2b8.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 12.2.svchost.exe.13f4f08c2b8.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 12.2.svchost.exe.13f4f08c2b8.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 9.2.svchost.exe.138aa701bf0.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 9.2.svchost.exe.138aa701bf0.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 9.2.svchost.exe.138aa701bf0.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 19.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 19.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 19.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 39.2.svchost.exe.1c2272eb590.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 39.2.svchost.exe.1c2272eb590.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 39.2.svchost.exe.1c2272eb590.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 24.2.svchost.exe.20a45700998.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 24.2.svchost.exe.20a45700998.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 24.2.svchost.exe.20a45700998.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 29.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 29.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 29.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 9.2.svchost.exe.138aa68c5a8.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 9.2.svchost.exe.138aa68c5a8.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 9.2.svchost.exe.138aa68c5a8.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 13.2.csc.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 13.2.csc.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 13.2.csc.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 12.2.svchost.exe.13f4f101900.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 12.2.svchost.exe.13f4f101900.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 12.2.svchost.exe.13f4f101900.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 13.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 13.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 13.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 12.2.svchost.exe.13f4f08c2b8.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 12.2.svchost.exe.13f4f08c2b8.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 9.2.svchost.exe.138aa701bf0.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 9.2.svchost.exe.138aa701bf0.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 9.2.svchost.exe.138aa701bf0.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 24.2.svchost.exe.20a4568b350.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 24.2.svchost.exe.20a4568b350.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 39.2.svchost.exe.1c227360bd8.2.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 39.2.svchost.exe.1c227360bd8.2.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 9.2.svchost.exe.138aa68c5a8.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 9.2.svchost.exe.138aa68c5a8.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 39.2.svchost.exe.1c2272eb590.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 39.2.svchost.exe.1c2272eb590.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 0000000C.00000002.1528643546.0000013F4F016000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000D.00000002.3800959907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000D.00000002.3800959907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0000000D.00000002.3800959907.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 00000013.00000002.1399213491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000013.00000002.1399213491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 00000013.00000002.1399213491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 0000001D.00000002.1492594141.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000001D.00000002.1492594141.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0000001D.00000002.1492594141.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
Source: 00000009.00000002.1595202046.00000138AA616000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000018.00000002.1546946748.0000020A45615000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000027.00000002.1623163422.000001C227275000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: svchost.exe PID: 7964, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: svchost.exe PID: 8048, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: csc.exe PID: 8164, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: ngen.exe PID: 7544, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: svchost.exe PID: 1072, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: wmplayer.exe PID: 2052, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: svchost.exe PID: 7920, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: qmgr.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsperf.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: firewallapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: esent.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: fwbase.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: flightsettings.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: netprofm.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: npmproxy.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsigd.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: upnp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ssdpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: appxdeploymentclient.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: wsmauto.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: wsmsvc.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dsrole.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: pcwum.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: wkscli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: msv1_0.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ntlmshared.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptdll.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: rmclient.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: usermgrcli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: execmodelclient.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: execmodelproxy.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: vssapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: vsstrace.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: samcli.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: samlib.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: es.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsproxy.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\System32\cmd.exe |
Section loaded: cmdext.dll |
Jump to behavior |
Source: C:\Windows\System32\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\System32\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\Windows\System32\timeout.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: microsoft.management.infrastructure.native.unmanaged.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wmidcom.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: winmm.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: urlmon.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: wininet.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: iertutil.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: srvcli.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: netutils.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: sspicli.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: mswsock.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: dnsapi.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: iphlpapi.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: rasadhlp.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: fwpuclnt.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: wersvc.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: windowsperformancerecordercontrol.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: weretw.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: xmllite.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: wldp.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: wer.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: faultrep.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: dbghelp.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: dbgcore.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: wer.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: userenv.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: profapi.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: sspicli.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
|
Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
|
Source: |
Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdbpte source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\dll\mscorlib.pdb source: svchost.exe, 00000009.00000002.1561024027.0000013898878000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1520877900.0000013F3D2F6000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: HC:\Windows\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Drawing.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Users\user\AppData\Roaming\svchost.PDB source: svchost.exe, 0000000C.00000002.1520877900.0000013F3D2F6000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdbh source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: symbols\dll\System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdbg source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdbRSDS7^3l source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Drawing.ni.pdbRSDS source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: !0\??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.ni.pdbRSDS# source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Core.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: Microsoft.VisualBasic.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbvider source: svchost.exe, 0000000C.00000002.1520490428.0000013F3D2B0000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\dll\mscorlib.pdb`?y source: svchost.exe, 00000009.00000002.1600531424.00000138B5200000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.pdb` source: WERF9D.tmp.dmp.32.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: svchost.exe, 0000000C.00000002.1520490428.0000013F3D2B0000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb* H source: svchost.exe, 00000009.00000002.1561362879.00000138988AC000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdbdbpdb source: svchost.exe, 0000000C.00000002.1532137769.0000013F57C73000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdb* source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.ni.pdbRSDS source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: xC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\mscorlib.pdb*k source: svchost.exe, 0000000C.00000002.1531557318.0000013F57C13000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\mscorlib.pdb source: svchost.exe, 00000009.00000002.1602148368.00000138B526F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Drawing.pdbUyJ source: WERF9D.tmp.dmp.32.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: C:\Windows\System.Windows.Forms.pdbpdbrms.pdbC:\Windows\System32\OneCoreCommonProxyStub.dll source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.ni.pdbRSDScUN source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1532137769.0000013F57C73000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: Microsoft.VisualBasic.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Xml.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: svchost.exe, 00000009.00000002.1600531424.00000138B5200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1561626202.00000138988D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.ni.pdbRSDS source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: C:\Windows\System.Windows.Forms.pdbpdbrms.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.pdbP%%=? source: WER81B.tmp.dmp.26.dr, WEREACF.tmp.dmp.21.dr |
Source: |
Binary string: System.Windows.Forms.pdb.Forms.pdbpdbrms.pdbm.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb? source: svchost.exe, 0000000C.00000002.1518275274.0000002190312000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: 91\??\C:\Windows\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\System.Windows.Forms.pdb\??\C:\Windows\symbols\dll\mscorlib.pdbShellItem Shell Namespace helper source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Configuration.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbao source: svchost.exe, 0000000C.00000002.1532137769.0000013F57C73000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: svchost.exe, 00000009.00000002.1561626202.00000138988D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1520490428.0000013F3D2B0000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: ()\??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1602148368.00000138B526F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1520417366.0000013F3D299000.00000004.00000020.00020000.00000000.sdmp, WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: mscorlib.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Windows.Forms.pdbt source: svchost.exe, 0000000C.00000002.1520417366.0000013F3D299000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\mscorlib.pdbok source: svchost.exe, 00000009.00000002.1561626202.00000138988D7000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdbp+) source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Drawing.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Core.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1602454442.00000138B5295000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdbF9E-7F9C-4437-8B11-F424491E3931}\ServerF9C-4437-8B11-F424491E3931}\InprocServer32 source: svchost.exe, 00000009.00000002.1601737927.00000138B525E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1531557318.0000013F57C6E000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.pdb0 source: WERF9D.tmp.dmp.32.dr |
Source: |
Binary string: System.Windows.Forms.pdb.Forms.pdbpdbrms.pdbm.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb8 source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdbn source: svchost.exe, 00000009.00000002.1600531424.00000138B5200000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: Microsoft.VisualBasic.pdbMZ@ source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: symbols\dll\System.Windows.Forms.pdb source: svchost.exe, 00000009.00000002.1556490544.00000003971E2000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.pdbP source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdb source: svchost.exe, 0000000C.00000002.1532212647.0000013F57C8F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.ni.pdb source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: |
Binary string: System.Core.ni.pdbRSDS source: WER81B.tmp.dmp.26.dr, WERF9D.tmp.dmp.32.dr, WEREC17.tmp.dmp.16.dr, WER1AC8.tmp.dmp.35.dr, WEREACF.tmp.dmp.21.dr, WER3015.tmp.dmp.47.dr |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\cmd.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\LisectAVT_2403002A_136.exe |
Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\svchost.exe |
Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
|