| Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04 |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000362E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2088110800.00000000035C9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, aw_sas32.dll.9.dr, is-PDD2G.tmp.3.dr, is-VCJTB.tmp.3.dr |
String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000362E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2088110800.00000000035C9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, aw_sas32.dll.9.dr, is-PDD2G.tmp.3.dr, is-VCJTB.tmp.3.dr |
String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t |
| Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2534997545.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060C8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.globalsign.com/gsgccr6alphasslca2023.crl0G |
| Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.globalsign.com/root-r6.crl0 |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s |
| Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0# |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0# |
| Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0# |
| Source: ast.exe, 0000000A.00000002.2980985284.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2513039914.0000000000D40000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php |
| Source: ast.exe, 0000000A.00000003.2973573202.0000000006088000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2953370709.000000000608B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f40;a~8 |
| Source: ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66 |
| Source: ast.exe, 0000000A.00000003.2947103567.000000000609D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66-80akicokc0aablc.x |
| Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66/ |
| Source: ast.exe, 0000000A.00000002.2992930514.0000000006088000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b660 |
| Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b667 |
| Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66G |
| Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66Q |
| Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66Y |
| Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66c |
| Source: ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66e |
| Source: ast.exe, 0000000A.00000002.2979445587.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66h |
| Source: ast.exe, 0000000A.00000003.2888461757.0000000006091000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2979445587.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66ln241119_8036.log |
| Source: ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66m |
| Source: ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66u |
| Source: ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php?id=142104603&stat=6f83f48b198bee1c21dc55ad2e0d1b66w |
| Source: ast.exe, 0000000B.00000002.2513039914.0000000000D40000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.phpy |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096624002.000000000341C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000362E000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2088110800.00000000035C9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, aw_sas32.dll.9.dr, is-PDD2G.tmp.3.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-VCJTB.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: http://ocsp.comodoca.com0 |
| Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2534997545.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060C8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp.globalsign.com/gsgccr6alphasslca20230W |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: http://ocsp.sectigo.com0 |
| Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp2.globalsign.com/rootr60; |
| Source: ast.exe, 0000000A.00000000.2386068044.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ast.exe.9.dr |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types |
| Source: ast.exe, 0000000A.00000002.2979445587.0000000000C20000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/e |
| Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2534997545.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060C8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr6alphasslca2023.crt0 |
| Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://secure.globalsign.com/cacert/root-r6.crt06 |
| Source: ast.exe, 0000000A.00000002.2979445587.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2513073562.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Types |
| Source: ast.exe, 0000000B.00000002.2513073562.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Types?fr |
| Source: ast.exe, 0000000B.00000002.2513073562.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/TypesYfT |
| Source: ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typesntime1 |
| Source: ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typespeg-tu |
| Source: ast.exe, 0000000A.00000002.2979445587.0000000000C28000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typesw)u |
| Source: ast.exe.9.dr |
String found in binary or memory: http://www.indyproject.org/ |
| Source: wjpP1EOX0L.exe, 00000000.00000003.1711898611.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000000.00000003.1711597591.0000000002460000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000000.1712569015.0000000000401000.00000020.00000001.01000000.00000004.sdmp, wjpP1EOX0L.tmp.0.dr |
String found in binary or memory: http://www.innosetup.com/ |
| Source: wjpP1EOX0L.exe |
String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU |
| Source: wjpP1EOX0L.exe, 00000000.00000003.1720539531.00000000022C2000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000002.00000003.2098213335.00000000022A5000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: http://www.kngstr.com/?PreDefines.ish |
| Source: wjpP1EOX0L.exe, 00000000.00000003.1720539531.00000000022AC000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000000.00000003.1710614762.0000000002460000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000003.1713559295.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000003.1716936096.00000000021FD000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000003.00000003.2086719713.000000000234D000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: http://www.kngstr.com/?PreDefines.ishAbout |
| Source: wjpP1EOX0L.tmp, 00000001.00000003.1716936096.00000000021F5000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000003.00000003.2086719713.0000000002345000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: http://www.kngstr.com/?PreDefines.isha |
| Source: ast.exe.9.dr |
String found in binary or memory: http://www.openssl.org/) |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2094846139.000000000361A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, is-VCJTB.tmp.3.dr |
String found in binary or memory: http://www.openssl.org/V |
| Source: wjpP1EOX0L.exe, 00000000.00000003.1711898611.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.exe, 00000000.00000003.1711597591.0000000002460000.00000004.00001000.00020000.00000000.sdmp, wjpP1EOX0L.tmp, 00000001.00000000.1712569015.0000000000401000.00000020.00000001.01000000.00000004.sdmp, wjpP1EOX0L.tmp.0.dr |
String found in binary or memory: http://www.remobjects.com/ps |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385054264.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2515695685.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmp |
String found in binary or memory: http://www.sqlite.org/copyright.html. |
| Source: ast.exe, 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr |
String found in binary or memory: https://curl.haxx.se/V |
| Source: ast.exe, 0000000A.00000002.2997269858.000000006B954000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr |
String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD |
| Source: ast.exe, ast.exe, 0000000A.00000002.2997000852.000000006B93B000.00000002.00000001.01000000.00000017.sdmp, is-JCPUK.tmp.3.dr, libcurl.dll.9.dr |
String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html |
| Source: ast.exe |
String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html# |
| Source: ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr |
String found in binary or memory: https://datatracker.ietf.org/ipr/1524/ |
| Source: ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr |
String found in binary or memory: https://datatracker.ietf.org/ipr/1526/ |
| Source: ast.exe, 0000000A.00000000.2388256151.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, ast.exe.9.dr |
String found in binary or memory: https://datatracker.ietf.org/ipr/1914/ |
| Source: ast.exe, 0000000A.00000003.2877051123.00000000060A0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888384413.000000000609F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn- |
| Source: ast.exe, 0000000A.00000002.2996363895.0000000008F8C000.00000004.00000010.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akico |
| Source: ast.exe, 0000000A.00000003.2474490964.000000000608D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aa |
| Source: ast.exe, 0000000A.00000003.2696699050.000000000608A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn-- |
| Source: ast.exe.9.dr |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai |
| Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai00 |
| Source: ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai03 |
| Source: ast.exe, 0000000A.00000002.2982914474.0000000003194000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai443... |
| Source: ast.exe, 0000000A.00000003.2856120074.0000000006087000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai: |
| Source: ast.exe, 0000000A.00000003.2706718804.00000000060A2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2696026958.00000000060F8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443 |
| Source: ast.exe, 0000000A.00000003.2551675843.0000000006097000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2561692182.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525993259.0000000006099000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443% |
| Source: ast.exe, 0000000A.00000003.2771015394.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935483270.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2787353293.000000000609D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443&w |
| Source: ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443- |
| Source: ast.exe, 0000000A.00000002.2982914474.000000000319B000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2472544479.00000000060BA000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443... |
| Source: ast.exe, 0000000A.00000002.2981320741.0000000002F43000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...43 |
| Source: ast.exe, 0000000A.00000002.2981320741.0000000002F43000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...43AW |
| Source: ast.exe, 0000000A.00000003.2877051123.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2993259885.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2787353293.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2429957558.0000000006092000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730238261.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2819335046.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888016220.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730618420.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2722515590.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2907031061.00000000060C3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/ |
| Source: ast.exe, 0000000A.00000002.2993259885.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2722515590.00000000060C3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/5 |
| Source: ast.exe, 0000000A.00000003.2787353293.00000000060C3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/6 |
| Source: ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/Cln241119_8036.log |
| Source: ast.exe, 0000000A.00000003.2745744616.00000000060C3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/Cln241119_8036.logw |
| Source: ast.exe, 0000000A.00000003.2746410358.00000000070B1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935989467.0000000006091000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2722515590.000000000609D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2746980219.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2826372339.00000000070C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.000000000608D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2745744616.00000000060ED000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935483270.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2429957558.0000000006092000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2972708017.00000000070C1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730238261.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2973227337.00000000060B9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2826675676.0000000006087000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2819180112.00000000070C4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2825441021.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888384413.000000000609F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2771015394.00000000060B7000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2935483270.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2877395342.000000000607B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec |
| Source: ast.exe, 0000000A.00000003.2730238261.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2819335046.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2888016220.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2730618420.00000000060C3000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2856120074.00000000060C3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/og |
| Source: ast.exe, 0000000A.00000002.2988967323.00000000042E4000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4430 |
| Source: ast.exe, 0000000A.00000003.2771015394.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2706718804.00000000060A2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4430wo~ |
| Source: ast.exe, 0000000A.00000003.2526279673.000000000607B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335 |
| Source: ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335- |
| Source: ast.exe, 0000000A.00000003.2452834986.000000000609A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452524284.0000000006086000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335/ |
| Source: ast.exe, 0000000A.00000003.2476123740.0000000006075000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335: |
| Source: ast.exe, 0000000A.00000002.2981320741.0000000002F4B000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335y |
| Source: ast.exe, 0000000A.00000003.2819563853.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.2992930514.00000000060A0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4434lo~p |
| Source: ast.exe, 0000000A.00000003.2551550301.00000000060F1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443: |
| Source: ast.exe, 0000000A.00000003.2877051123.00000000060A0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443Io |
| Source: ast.exe, 0000000A.00000002.2979445587.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443K |
| Source: ast.exe, 0000000A.00000003.2476123740.0000000006075000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2452887279.0000000006075000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443L |
| Source: ast.exe, 0000000A.00000003.2746778261.00000000060A4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443Ow |
| Source: ast.exe, 0000000A.00000003.2435889428.0000000006075000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443U |
| Source: ast.exe, 0000000A.00000003.2907031061.00000000060A5000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443Vw |
| Source: ast.exe, 0000000A.00000003.2787353293.000000000609D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443Wl |
| Source: ast.exe, 0000000A.00000003.2819563853.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2746778261.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2670067675.000000000609D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443aw |
| Source: ast.exe, 0000000A.00000003.2856120074.00000000060A2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443ers |
| Source: ast.exe, 0000000A.00000003.2551675843.0000000006097000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443l |
| Source: ast.exe, 0000000A.00000003.2474490964.000000000608D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443r |
| Source: ast.exe, 0000000A.00000003.2670067675.000000000609D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443sw.~ |
| Source: ast.exe, 0000000A.00000003.2430087607.000000000605F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443t: |
| Source: ast.exe, 0000000A.00000003.2551550301.00000000060F1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2535632567.000000000607B000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526279673.000000000607B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443w |
| Source: ast.exe, 0000000A.00000003.2552338521.0000000006075000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443y |
| Source: ast.exe, 0000000A.00000003.2746778261.00000000060A4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443zo- |
| Source: ast.exe, 0000000A.00000002.2995912080.00000000075CD000.00000004.00000010.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiDUdu |
| Source: ast.exe, 0000000A.00000003.2552338521.0000000006061000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai_ |
| Source: ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aid003 |
| Source: ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aidll03 |
| Source: ast.exe, 0000000A.00000002.2981320741.0000000002F84000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aie03 |
| Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2430087607.000000000605F000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiexe |
| Source: ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiexe7 |
| Source: ast.exe, 0000000A.00000003.2797214316.0000000006064000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiexel |
| Source: ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aill |
| Source: ast.exe, 0000000A.00000002.2979445587.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aillll |
| Source: ast.exe, 0000000A.00000003.2476123740.0000000006060000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aillx; |
| Source: ast.exe, 0000000A.00000002.2982914474.0000000003194000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiq |
| Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ais.dll |
| Source: ast.exe, 0000000A.00000003.2452887279.0000000006060000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ait.dll |
| Source: ast.exe, 0000000A.00000003.2436010829.0000000006071000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2435889428.0000000006065000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ait.l; |
| Source: ast.exe, 0000000A.00000002.2992252088.0000000006020000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aixh-~ |
| Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: https://sectigo.com/CPS0 |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://sectigo.com/CPS0B |
| Source: wjpP1EOX0L.tmp, 00000003.00000003.2082364759.000000000701D000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2096546624.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2385110004.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr |
String found in binary or memory: https://sectigo.com/CPS0C |
| Source: xcopy.exe, 00000009.00000003.2083727096.00000000035DA000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2098265032.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2087883460.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2089288252.000000000360A000.00000004.00000020.00020000.00000000.sdmp, opus.dll.9.dr, astrct.dll.9.dr, is-951GK.tmp.3.dr, is-UA1D6.tmp.3.dr |
String found in binary or memory: https://sectigo.com/CPS0D |
| Source: ast.exe, 0000000A.00000003.2525562643.00000000060D9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2534997545.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2526220762.0000000006089000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2474490964.00000000060A4000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000003.2525562643.00000000060C8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.globalsign.com/repository/0D |
| Source: xcopy.exe, 00000009.00000003.2089288252.00000000035F7000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000009.00000003.2097505417.0000000003418000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000A.00000002.3006978493.000000006CA52000.00000002.00000001.01000000.00000013.sdmp, ast.exe, 0000000A.00000002.3000753196.000000006BE60000.00000002.00000001.01000000.00000014.sdmp, is-UA1D6.tmp.3.dr |
String found in binary or memory: https://www.openssl.org/H |
| Source: is-VCJTB.tmp.3.dr |
String found in binary or memory: https://www.openssl.org/docs/faq.html |
| Source: C:\Users\user\Desktop\wjpP1EOX0L.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\wjpP1EOX0L.exe |
Section loaded: apphelp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: textinputframework.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: coreuicomponents.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: rstrtmgr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: ncrypt.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: ntasn1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: edputil.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: urlmon.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: iertutil.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: srvcli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: appresolver.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: bcp47langs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: slc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: sppc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-JOUMC.tmp\wjpP1EOX0L.tmp |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\wjpP1EOX0L.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\wjpP1EOX0L.exe |
Section loaded: apphelp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: textinputframework.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: coreuicomponents.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: rstrtmgr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: ncrypt.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: ntasn1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: textshaping.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: dwmapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: sfc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: sfc_os.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-9TM7I.tmp\wjpP1EOX0L.tmp |
Section loaded: explorerframe.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\cmd.exe |
Section loaded: cmdext.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\cmd.exe |
Section loaded: apphelp.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: ulib.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: ifsutil.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: devobj.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: fsutilext.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: olepro32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wininet.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wsock32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wtsapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winmm.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: sqlite3.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: crtdll.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: msacm32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: quartz.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: msvfw32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: avifil32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wkscli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: logoncli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: samcli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: colorui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: mscms.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: coloradapterclient.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: compstui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: inetres.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: security.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winsta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: scrrun.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: sxs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dbghelp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dbgcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: cscapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: d3d11.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dxgi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: astcrp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: libssl-1_1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: libcrypto-1_1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: libcrypto-1_1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: vcruntime140.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: vcruntime140.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: napinsp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: pnrpnsp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wshbth.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: nlaapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: mswsock.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winrnr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: amsi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: textshaping.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: powrprof.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: umpdc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dataexchange.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dcomp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: iertutil.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winnsi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: schannel.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: textinputframework.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: coreuicomponents.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: symsrv.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: urlmon.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: srvcli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: olepro32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wininet.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wsock32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wtsapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winmm.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: sqlite3.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: crtdll.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: msacm32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: quartz.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: msvfw32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: avifil32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wkscli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: logoncli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: samcli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: colorui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: mscms.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: coloradapterclient.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: compstui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: inetres.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: security.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: winsta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: scrrun.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
Section loaded: sxs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\im\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet