| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0 |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0 |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C |
| Source: xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.dr |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04 |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917190555.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.000000000299A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917539418.0000000002937000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917190555.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.000000000299A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917539418.0000000002937000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t |
| Source: ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.globalsign.com/gsgccr6alphasslca2023.crl0G |
| Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.globalsign.com/root-r6.crl0 |
| Source: ast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.globalsign.com/root-r6.crl0o |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr |
String found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.dr |
String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s |
| Source: xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.dr |
String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0 |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0 |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0 |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0 |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr |
String found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0# |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.dr |
String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0# |
| Source: xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.dr |
String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0# |
| Source: ast.exe, 0000000E.00000002.2405241145.00000000027F0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crypto-st.art/update.php |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917190555.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.000000000299A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917539418.0000000002937000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920462940.000000000271C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.dr |
String found in binary or memory: http://ocsp.comodoca.com0 |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://ocsp.digicert.com0 |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://ocsp.digicert.com0A |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://ocsp.digicert.com0C |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://ocsp.digicert.com0X |
| Source: ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp.globalsign.com/gsgccr6alphasslca20230W |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr, astclient.dll.10.dr |
String found in binary or memory: http://ocsp.sectigo.com0 |
| Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp2.globalsign.com/rootr60; |
| Source: ast.exe, 0000000B.00000000.2212062747.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.dr |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types |
| Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/xe |
| Source: ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr6alphasslca2023.crt0 |
| Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://secure.globalsign.com/cacert/root-r6.crt06 |
| Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2708118285.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Types |
| Source: ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Types% |
| Source: ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Types6 |
| Source: ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/TypesM |
| Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Types_9 |
| Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typescrypto |
| Source: ast.exe, 0000000E.00000002.2404512977.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typesd |
| Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typesuntime |
| Source: ast.exe, 0000000B.00000002.2708118285.0000000000D48000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typeswuu |
| Source: ast.exe, 0000000B.00000002.2708118285.0000000000D40000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typesx6 |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: http://www.digicert.com/CPS0 |
| Source: is-HTIEL.tmp.4.dr |
String found in binary or memory: http://www.indyproject.org/ |
| Source: is-HTIEL.tmp.4.dr |
String found in binary or memory: http://www.openssl.org/) |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918880338.0000000002986000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr |
String found in binary or memory: http://www.openssl.org/V |
| Source: is-V6G0T.tmp.4.dr |
String found in binary or memory: http://www.openssl.org/support/faq.html |
| Source: is-V6G0T.tmp.4.dr |
String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210198268.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000D.00000002.2327717208.0000000061EA0000.00000008.00000001.01000000.0000000D.sdmp |
String found in binary or memory: http://www.sqlite.org/copyright.html. |
| Source: ast.exe, 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmp |
String found in binary or memory: https://curl.haxx.se/V |
| Source: ast.exe, 0000000B.00000002.2722071506.000000006BE04000.00000002.00000001.01000000.00000017.sdmp |
String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD |
| Source: xcopy.exe, 0000000A.00000003.1919605698.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, ast.exe, ast.exe, 0000000B.00000002.2721900400.000000006BDEB000.00000002.00000001.01000000.00000017.sdmp |
String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html |
| Source: ast.exe |
String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html# |
| Source: ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.dr |
String found in binary or memory: https://datatracker.ietf.org/ipr/1524/ |
| Source: ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.dr |
String found in binary or memory: https://datatracker.ietf.org/ipr/1526/ |
| Source: ast.exe, 0000000B.00000000.2214853224.0000000000942000.00000002.00000001.01000000.0000000C.sdmp, is-HTIEL.tmp.4.dr |
String found in binary or memory: https://datatracker.ietf.org/ipr/1914/ |
| Source: ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn- |
| Source: ast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80a |
| Source: ast.exe, 0000000B.00000002.2720318166.000000000650C000.00000004.00000010.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akico |
| Source: ast.exe, 0000000B.00000003.2460874632.0000000005BC2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BDA000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aa |
| Source: ast.exe, 0000000B.00000003.2288476613.0000000005BDA000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aaP |
| Source: is-HTIEL.tmp.4.dr |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai |
| Source: ast.exe, 0000000B.00000002.2718754874.0000000005B88000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai00 |
| Source: ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai03 |
| Source: ast.exe, 0000000B.00000002.2709418895.0000000002F32000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai1 |
| Source: ast.exe, 0000000B.00000002.2709418895.0000000002F32000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443 |
| Source: ast.exe, 0000000B.00000002.2720318166.000000000650C000.00000004.00000010.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443... |
| Source: ast.exe, 0000000B.00000002.2709418895.0000000002F23000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443...43 |
| Source: ast.exe, 0000000B.00000003.2336663632.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005C04000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/ |
| Source: ast.exe, 0000000B.00000002.2718754874.0000000005C04000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/Log |
| Source: ast.exe, 0000000B.00000003.2425639731.0000000005C0D000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2460667987.0000000005C04000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/api/exec |
| Source: ast.exe, 0000000B.00000003.2336663632.0000000005C02000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443/tClnstCln |
| Source: ast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4432 |
| Source: ast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:4433 |
| Source: ast.exe, 0000000B.00000002.2709418895.0000000002F2B000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335 |
| Source: ast.exe, 0000000B.00000002.2710811222.0000000003152000.00000004.00001000.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335- |
| Source: ast.exe, 0000000B.00000002.2710811222.000000000314B000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335... |
| Source: ast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:44335/api/exec |
| Source: ast.exe, 0000000B.00000003.2460874632.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443RW |
| Source: ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443SI |
| Source: ast.exe, 0000000B.00000003.2363714018.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2336448697.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2425540333.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443n |
| Source: ast.exe, 0000000B.00000003.2288302792.0000000005BF4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443nA |
| Source: ast.exe, 0000000B.00000003.2288302792.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443rO |
| Source: ast.exe, 0000000B.00000003.2460874632.0000000005BD1000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ai:443uIz |
| Source: ast.exe, 0000000B.00000002.2718754874.0000000005B88000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiE |
| Source: ast.exe, 0000000B.00000002.2721303645.00000000085AD000.00000004.00000010.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiI |
| Source: ast.exe, 0000000B.00000003.2336663632.0000000005BD0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aiU |
| Source: ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aid003 |
| Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aidll |
| Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aidllb/y |
| Source: ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aillQ/ |
| Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aillU |
| Source: ast.exe, 0000000B.00000003.2460667987.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aills |
| Source: ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ainkEx |
| Source: ast.exe, 0000000B.00000002.2718754874.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ainke |
| Source: ast.exe, 0000000B.00000003.2288476613.0000000005BC2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1airq |
| Source: ast.exe, 0000000B.00000002.2709418895.0000000002F64000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1aixe03 |
| Source: ast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablc.xn--p1ar |
| Source: ast.exe, 0000000B.00000003.2270346280.0000000005BBC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://id.xn--80akicokc0aablcZ |
| Source: oZ3vtWXObB.exe |
String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU |
| Source: xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.dr |
String found in binary or memory: https://sectigo.com/CPS0 |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr |
String found in binary or memory: https://sectigo.com/CPS0B |
| Source: oZ3vtWXObB.tmp, 00000004.00000003.1898790130.0000000005DCC000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.2210276732.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1920028093.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, is-V6G0T.tmp.4.dr |
String found in binary or memory: https://sectigo.com/CPS0C |
| Source: xcopy.exe, 0000000A.00000003.1921257541.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916463173.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1917115603.000000000270F000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1913521432.0000000002945000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1916642893.00000000026F8000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 0000000A.00000003.1918204929.000000000297F000.00000004.00000020.00020000.00000000.sdmp, astclient.dll.10.dr |
String found in binary or memory: https://sectigo.com/CPS0D |
| Source: ast.exe, 0000000B.00000003.2364006508.0000000005C02000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363633348.0000000005C34000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2363714018.0000000005C32000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000003.2364006508.0000000005BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.globalsign.com/repository/0D |
| Source: oZ3vtWXObB.exe, 00000000.00000003.1452548810.0000000002660000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.exe, 00000000.00000003.1452968553.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.tmp, 00000002.00000000.1454410842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, xcopy.exe, 0000000A.00000003.2210610570.0000000002911000.00000004.00000020.00020000.00000000.sdmp, is-U37IG.tmp.4.dr |
String found in binary or memory: https://www.innosetup.com/ |
| Source: xcopy.exe, 0000000A.00000003.1918204929.000000000296C000.00000004.00000020.00020000.00000000.sdmp, ast.exe, 0000000B.00000002.2726140160.000000006C3B2000.00000002.00000001.01000000.00000013.sdmp, ast.exe, 0000000B.00000002.2725071368.000000006C310000.00000002.00000001.01000000.00000014.sdmp |
String found in binary or memory: https://www.openssl.org/H |
| Source: xcopy.exe, 0000000A.00000003.1918880338.000000000294B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.openssl.org/docs/faq.html |
| Source: oZ3vtWXObB.exe, 00000000.00000003.1452548810.0000000002660000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.exe, 00000000.00000003.1452968553.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, oZ3vtWXObB.tmp, 00000002.00000000.1454410842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, xcopy.exe, 0000000A.00000003.2210610570.0000000002911000.00000004.00000020.00020000.00000000.sdmp, is-U37IG.tmp.4.dr |
String found in binary or memory: https://www.remobjects.com/ps |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: apphelp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: wtsapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: winsta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: textinputframework.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: coreuicomponents.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: rstrtmgr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: ncrypt.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: ntasn1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: edputil.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: urlmon.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: iertutil.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: srvcli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: appresolver.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: bcp47langs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: slc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: sppc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-GEEHR.tmp\oZ3vtWXObB.tmp |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\Desktop\oZ3vtWXObB.exe |
Section loaded: apphelp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: wtsapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: winsta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: textinputframework.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: coreuicomponents.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: rstrtmgr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: ncrypt.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: ntasn1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: textshaping.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: dwmapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: explorerframe.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: sfc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Local\Temp\is-30F0I.tmp\oZ3vtWXObB.tmp |
Section loaded: sfc_os.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\cmd.exe |
Section loaded: cmdext.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\cmd.exe |
Section loaded: apphelp.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: ulib.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: ifsutil.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: devobj.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: fsutilext.dll |
Jump to behavior |
| Source: C:\Windows\SysWOW64\xcopy.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: olepro32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wininet.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wsock32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wtsapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmm.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sqlite3.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: crtdll.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msacm32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: quartz.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msvfw32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: avifil32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wkscli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: logoncli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: samcli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: colorui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: mscms.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: coloradapterclient.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: compstui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: inetres.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: security.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winsta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: scrrun.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sxs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dbghelp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dbgcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: cscapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: d3d11.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dxgi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: astcrp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: libssl-1_1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: libcrypto-1_1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: libcrypto-1_1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: vcruntime140.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: napinsp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: pnrpnsp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wshbth.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: nlaapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: mswsock.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winrnr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: amsi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: textshaping.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: powrprof.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: umpdc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dataexchange.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dcomp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: iertutil.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winnsi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: schannel.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: textinputframework.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: coreuicomponents.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: olepro32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wininet.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wsock32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wtsapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmm.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sqlite3.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: crtdll.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msacm32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: quartz.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msvfw32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: avifil32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wkscli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: logoncli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: samcli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: colorui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: mscms.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: coloradapterclient.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: compstui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: inetres.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: security.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winsta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: scrrun.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sxs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: olepro32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wininet.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wsock32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wtsapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmm.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: shfolder.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sqlite3.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: crtdll.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msacm32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: quartz.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msvfw32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: avifil32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winmmbase.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wkscli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: logoncli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: samcli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: colorui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: mscms.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: coloradapterclient.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: compstui.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: inetres.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: msimg32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: security.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: winsta.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: scrrun.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
Section loaded: sxs.dll |
Jump to behavior |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
| Source: C:\Users\user\AppData\Roaming\is\ast.exe |
WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE Caption='C:' |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet