Source: unknown | TCP traffic detected without corresponding DNS query: 71.197.138.217 |
Source: unknown | TCP traffic detected without corresponding DNS query: 71.197.138.217 |
Source: unknown | TCP traffic detected without corresponding DNS query: 71.197.138.217 |
Source: unknown | TCP traffic detected without corresponding DNS query: 71.197.138.217 |
Source: unknown | TCP traffic detected without corresponding DNS query: 71.197.138.217 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 71.197.138.217 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 71.197.138.217 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 80.241.214.102 |
Source: unknown | TCP traffic detected without corresponding DNS query: 80.241.214.102 |
Source: unknown | TCP traffic detected without corresponding DNS query: 80.241.214.102 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.23.76.52 |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB24B000.00000002.00000001.01000000.00000003.sdmp, 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB6DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: http://.css |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB24B000.00000002.00000001.01000000.00000003.sdmp, 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB6DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: http://.jpg |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: http://169.254.169.254resolve |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: http://169.254.170.2EnvConfigCredentialsinvalid |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D08E000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2090311775.0000014D0CA89000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0 |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D08E000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2090311775.0000014D0CA89000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07 |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2090311775.0000014D0CA89000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D08E000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2090311775.0000014D0CA89000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0 |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: http://dlhcij5vw7utoxi2nvqtmf7t27vud2l2euqqm6qqaknpjjcma36pfyad.onion/receive-----BEGIN |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB24B000.00000002.00000001.01000000.00000003.sdmp, 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB6DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: http://html4/loose.dtd |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D08E000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2090311775.0000014D0CA89000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.com0 |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB6DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://1098762253.rsc.cdn77.org/ |
Source: tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks.%s |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://2019.www.torproject.org/docs/tor-manual.html.en) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://blog.torproject.org/lifecycle-of-a-new-relay |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://blog.torproject.org/lifecycle-of-a-new-relayset |
Source: tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://blog.torproject.org/v2-deprecation-timeline |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://bridges.torproject.org/status?id=%s |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://bridges.torproject.org/status?id=%suninitialized |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/14917. |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/21155. |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/8742. |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://community.torproject.org/relay/setup/snowflake/) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/ |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://discord.com/api/v9/users/ |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D130000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://excel.office.com |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://freehaven.net/anonbib/#hs-attack06 |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://github.com/cohosh/snowbox. |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://github.com/refraction-networking/gotapdance) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://gitlab.torproject.org/cohosh/phantombox) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/wikis/home) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://gitlab.torproject.org/tpo/core/tor/ |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://ipapi.co//json/ |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://ipapi.co//json/0 |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://ipapi.co//json/x |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://jhalderm.com/pub/papers/conjure-ccs19.pdf) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://location.ipfire.org/ |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://location.ipfire.org/. |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB6DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://meek.azureedge.net/ |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://metrics.torproject.org/rs.html#details/A84C946BF4E14E63A3C92E140532A4594F2C24CD). |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://oidc-fips.GetRoleCredentialsAssumeRoleWithSAMLRetryMetricsHeaderRecursionDetectionThrottledE |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D130000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://outlook.com |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://portal.sso-fips.AddRawResponseToMetadataAWS_LAMBDA_FUNCTION_NAMEFailed |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://portal.sso.unable |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://refraction.network/info) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB6DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://registration.refraction.network/api |
Source: tor.exe, 00000002.00000003.2180104789.00000269FA7A1000.00000004.00000020.00020000.00000000.sdmp, tor.exe, 00000002.00000003.2178900724.00000269F8DE9000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://sabotage.net |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://snowflake.torproject.org/. |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://sqs-fips.VisibilityTimeoutusername |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://sts-fips.TransitiveTagKeys&X-Amz-Signature=CloseResponseBodyaws-us-gov-globalusername |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://sts.amazonaws.comRequestThrottledExceptionsqs-fips. |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://support.torproject.org/faq/staying-anonymous/ |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://support.torproject.org/faq/staying-anonymous/alphabetaThis |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://travis-ci.org/keroserene/snowflake) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://travis-ci.org/keroserene/snowflake.svg?branch=master) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://www.cloudflare.com/cdn-cgi/trace |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://www.cloudflare.com/cdn-cgi/trace0) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://www.cloudflare.com/cdn-cgi/traceh |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://www.gnu.org/licenses/gpl-3.0.en.html) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://www.torproject.org/ |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp, tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://www.torproject.org/docs/faq.html#BestOSForRelay |
Source: tor.exe, 00000002.00000000.2111931903.00007FF7911A6000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: https://www.torproject.org/documentation.html |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EC0DB000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: https://www.vagrantup.com/). |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: secur32.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: pdh.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: vcruntime140.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: perfos.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: rasadhlp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: fwpuclnt.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: schannel.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: mskeyprotect.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: ncryptsslp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Section loaded: cryptnet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: dhcpcsvc6.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: dhcpcsvc.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\.tmp5ZU4s6\tor\tor.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: ifmon.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: mprapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasmontr.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasapi32.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: fwpuclnt.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasman.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: mfc42u.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasman.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: authfwcfg.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: fwpolicyiomgr.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: firewallapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: fwbase.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: dhcpcmonitor.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: dot3cfg.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: dot3api.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: onex.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: eappcfg.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: eappprxy.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: fwcfg.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: hnetmon.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: netshell.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: nlaapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: netsetupapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: netiohlp.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: dhcpcsvc.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: winnsi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: nettrace.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: nshhttp.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: httpapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: nshipsec.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: activeds.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: polstore.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: winipsec.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: adsldpc.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: adsldpc.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: nshwfp.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: cabinet.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: p2pnetsh.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: p2p.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: rpcnsh.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wcnnetsh.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wlanapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: whhelper.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wlancfg.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wshelper.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wevtapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wwancfg.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wwapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wcmapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: rmclient.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: mobilenetworking.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: peerdistsh.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: ktmw32.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: mprmsg.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: atl.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: mscoree.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: vcruntime140_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ucrtbase_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: ucrtbase_clr0400.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: msisip.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: wshext.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: appxsip.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: opcservices.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: secur32.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vbscript.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sxs.dll | Jump to behavior |
Source: C:\Users\user\Desktop\4c9ebxnhQk.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\netsh.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: tor.exe, 00000002.00000002.3312718897.00000269FC34D000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: MIGJAoGBAMK1FHhz4de3qXltieuMlXNJ62ExEwMbZ2tV57qEmuK15Nh1Jfx1KnmL |
Source: tor.exe, 00000002.00000003.2318016728.00000269FAEE7000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: sRb6ltCcjOr6sn2S+B7A+OrE249Kp4YKDiJeNGzQMDiuLGvftzX/43hhGFS1R8ul |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V Hypervisor Root Virtual Processor |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF0F000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V Dynamic Memory Integration Service |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D130000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D0BC000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000% |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF0F000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: THyper-V Hypervisor Root Virtual Processor |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: JHyper-V Hypervisor Logical Processor |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DHyper-V Hypervisor Root Partition |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2074668124.0000014D0C7E2000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2074586608.0000014D0C7E2000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2074706297.0000014D0C7E2000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2075439005.0000014D0C7E2000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec487 |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2074848288.0000014D0C764000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: 4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: DHyper-V Virtual Machine Bus Pipes |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D0A7000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2090311775.0000014D0CA89000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V RAW |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF0F000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V Hypervisor Root Partition^* |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2074461290.0000014D0C7E4000.00000004.00000020.00020000.00000000.sdmp, 4c9ebxnhQk.exe, 00000000.00000003.2074363339.0000014D0C7E2000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count SnapshotWWH |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2063960768.0000014D0C76A000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Pos |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF0F000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V rjcyysyllhnhrfp Bus |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF0F000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V Hypervisor Root Partition |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: VHyper-V Dynamic Memory Integration Service |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: sWDHyper-V Hypervisor Root PartitionnJ |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D130000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}, |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: VHyper-V Dynamic Memory Integration Service |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2061391723.0000014D0C721000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V Hypervisor Logical Processormui |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: Fruntime dropped the dispatch taskuser code panickedconnection closedMsMpEng.exeavastui.exemcafee.exeavp.exebdservicehost.exeNortonSecurity.exeSophosUI.exeegui.exeMBAM.exeSpybotSD.exeAdwCleaner.exezonealarm.execfp.exepfw.exewrsa.exetmsrvc.exefsav.execleaner.exerevoUninstaller.exeTrueImageLauncher.exereflect.exetaskmgr.exeregedit.exevboxheadless.exevmware-vmx.exesandboxie.exeteamviewer.exeTeamViewer_Service.exeAnyDesk.exemstsc.exeLogMeIn.exeveracrypt.exebitlocker.exeVmRemoteGuest.exeSysmon64.exeH |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D130000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000 |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6EB05F000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: %sSHUTDOWN-ACKNo User DataHMAC SHA-128HMAC SHA-256State CookieHost Name IPDelete IP IPavx5124fmapsavx512bitalguncompressedeccsi_sha256192.0.0.0/24192.0.2.0/24CircleMinus;CircleTimes;Equilibrium;GreaterLess;LeftCeiling;LessGreater;MediumSpace;NotPrecedes;NotSucceeds;OverBracket;RightVector;Rrightarrow;RuleDelayed;SmallCircle;SquareUnion;SubsetEqual;UpDownArrow;Updownarrow;VerticalBar;backepsilon;blacksquare;circledcirc;circleddash;curlyeqprec;curlyeqsucc;diamondsuit;eqslantless;expectation;nRightarrow;nrightarrow;preccurlyeq;precnapprox;quaternions;straightphi;succcurlyeq;succnapprox;thickapprox;updownarrow;NotLessLess;NotSuperset;InstAltMatchunexpected )altmatch -> anynotnl -> refreshTokenclientSecretfield %q, %wClientSecretListAccountsawsssoportalSessionTokenSerialNumberread all: %vtokenize: %vcanceled, %vca-central-1eu-central-1eu-central-2il-central-1me-central-1caller errorBadRecordMacAccessDeniedDecryptErrorUserCanceledunknown type = struct { > but have <aws4_requestCfgMgr32.dllsetupapi.dllwintrust.dllwtsapi32.dllReportEventWCreateMutexWGetProcessIdLoadResourceLockResourceReleaseMutexResumeThreadSetErrorModeSetStdHandleThread32NextVirtualAllocNtCreateFileCoCreateGuidAMDisbetter!AuthenticAMDCentaurHaulsGenuineIntelTransmetaCPUGenuineTMx86Geode by NSCVIA VIA VIA KVMKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMbhyve bhyve HygonGenuineHandler endedlogToStateDirCMETHOD-ERRORUsage of %s: |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF0F000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V rjcyysyllhnhrfp Bus Pipes |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D130000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: NXTcaVMWare |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF0F000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V Virtual Machine Bus Pipes |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF0F000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V Virtual Machine Bus Pipesl |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2088204825.0000014D0D130000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: VMware SATA CD00 |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2063044870.0000014D0AF6E000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: tifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: JHyper-V Hypervisor Logical Processor |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V HypervisorpL\ |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: X2Hyper-V VM Vid Partition4S, |
Source: 4c9ebxnhQk.exe, 00000000.00000000.2050164890.00007FF6E9C5F000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: runtime dropped the dispatch taskuser code panickedconnection closedMsMpEng.exeavastui.exemcafee.exeavp.exebdservicehost.exeNortonSecurity.exeSophosUI.exeegui.exeMBAM.exeSpybotSD.exeAdwCleaner.exezonealarm.execfp.exepfw.exewrsa.exetmsrvc.exefsav.execleaner.exerevoUninstaller.exeTrueImageLauncher.exereflect.exetaskmgr.exeregedit.exevboxheadless.exevmware-vmx.exesandboxie.exeteamviewer.exeTeamViewer_Service.exeAnyDesk.exemstsc.exeLogMeIn.exeveracrypt.exebitlocker.exeVmRemoteGuest.exeSysmon64.exe |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: &Hyper-V Hypervisors5V |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2091714920.0000014D0AF38000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: 2Hyper-V VM Vid Partition.dll |
Source: 4c9ebxnhQk.exe, 00000000.00000003.2074505864.0000014D0C762000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Si |