Source: | Binary string: wkernel32.pdb source: svchost.exe, 00000011.00000003.1989955906.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1990288577.00000000056A0000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wkernelbase.pdb source: svchost.exe, 00000011.00000003.1990494240.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1990665098.00000000057A0000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: ntdll.pdb source: svchost.exe, 00000011.00000003.1987255253.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1987608690.0000000005770000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wntdll.pdbUGP source: svchost.exe, 00000011.00000003.1989003267.0000000005720000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1988235306.0000000005580000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: ntdll.pdbUGP source: svchost.exe, 00000011.00000003.1987255253.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1987608690.0000000005770000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wntdll.pdb source: svchost.exe, 00000011.00000003.1989003267.0000000005720000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1988235306.0000000005580000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wkernelbase.pdbUGP source: svchost.exe, 00000011.00000003.1990494240.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1990665098.00000000057A0000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wkernel32.pdbUGP source: svchost.exe, 00000011.00000003.1989955906.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1990288577.00000000056A0000.00000004.00000001.00020000.00000000.sdmp |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.216.18.169 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://ccsca2021.ocsp-certum.com05 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://crl.certum.pl/ctnca.crl0k |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0 |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0 |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://ocsp2.globalsign.com/rootr306 |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://ocsp2.globalsign.com/rootr606 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://repository.certum.pl/ctnca.cer09 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://repository.certum.pl/ctnca2.cer09 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08 |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://subca.ocsp-certum.com01 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://subca.ocsp-certum.com02 |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://subca.ocsp-certum.com05 |
Source: Amcache.hve.23.dr | String found in binary or memory: http://upx.sf.net |
Source: Hunt.com, 0000000C.00000000.1748412659.00000000003D5000.00000002.00000001.01000000.00000008.sdmp, Groups.8.dr, Hunt.com.1.dr | String found in binary or memory: http://www.autoitscript.com/autoit3/X |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: http://www.certum.pl/CPS0 |
Source: svchost.exe, 00000011.00000003.2057443921.000000000350C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2058419383.0000000003504000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2057900908.0000000002DDC000.00000004.00000010.00020000.00000000.sdmp, fontdrvhost.exe, fontdrvhost.exe, 00000015.00000002.2234883949.0000027FBA4A0000.00000040.00000001.00020000.00000000.sdmp | String found in binary or memory: https://154.216.18.169:5586/bc9bf2d44d45cc63/4822q3wa.b7epi |
Source: svchost.exe, 00000011.00000003.2057443921.000000000350C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2058419383.0000000003504000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.2234883949.0000027FBA4A0000.00000040.00000001.00020000.00000000.sdmp | String found in binary or memory: https://154.216.18.169:5586/bc9bf2d44d45cc63/4822q3wa.b7epikernelbasentdllkernel32GetProcessMitigati |
Source: svchost.exe, 00000011.00000002.2057900908.0000000002DDC000.00000004.00000010.00020000.00000000.sdmp | String found in binary or memory: https://154.216.18.169:5586/bc9bf2d44d45cc63/4822q3wa.b7epix |
Source: svchost.exe, 00000011.00000003.2023353754.00000000035A0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://cloudflare-dns.com/dns-query |
Source: svchost.exe, 00000011.00000003.2023353754.00000000035A0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi |
Source: Xnxx.8.dr, Hunt.com.1.dr | String found in binary or memory: https://www.autoitscript.com/autoit3/ |
Source: 1E3Vcm2yrA.exe | String found in binary or memory: https://www.certum.pl/CPS0 |
Source: Hunt.com.1.dr | String found in binary or memory: https://www.globalsign.com/repository/0 |
Source: unknown | Process created: C:\Users\user\Desktop\1E3Vcm2yrA.exe "C:\Users\user\Desktop\1E3Vcm2yrA.exe" | |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Levels Levels.cmd & Levels.cmd | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\tasklist.exe tasklist | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa" | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\tasklist.exe tasklist | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 22694 | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Heroes | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "AL" Speaks | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 22694\Hunt.com + Actors + Competition + Millions + Operates + Wendy + Ships + Ram + Sewing + Groups + Xnxx 22694\Hunt.com | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Lie + ..\Scary + ..\Performing + ..\Facial + ..\Omega + ..\Driven + ..\Litigation + ..\Addressing + ..\Calendar D | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com Hunt.com D | |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 | |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe" | |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7852 -s 988 | |
Source: C:\Windows\SysWOW64\svchost.exe | Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe" | |
Source: C:\Windows\System32\fontdrvhost.exe | Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3940 -s 144 | |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Levels Levels.cmd & Levels.cmd | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\tasklist.exe tasklist | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa" | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\tasklist.exe tasklist | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 22694 | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Heroes | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "AL" Speaks | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 22694\Hunt.com + Actors + Competition + Millions + Operates + Wendy + Ships + Ram + Sewing + Groups + Xnxx 22694\Hunt.com | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Lie + ..\Scary + ..\Performing + ..\Facial + ..\Omega + ..\Driven + ..\Litigation + ..\Addressing + ..\Calendar D | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com Hunt.com D | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe" | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe" | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: shfolder.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: iconcodecservice.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: windowscodecs.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: riched20.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: usp10.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: msls31.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: textinputframework.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: coreuicomponents.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: textshaping.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Section loaded: cmdext.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: framedynos.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: dbghelp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: winsta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: framedynos.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: dbghelp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: winsta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: cabinet.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: textinputframework.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: coreuicomponents.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\extrac32.exe | Section loaded: textshaping.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: wsock32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: napinsp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: pnrpnsp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: wshbth.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: nlaapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: winrnr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Section loaded: rasadhlp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\choice.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: devobj.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: drprov.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: winsta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: ntlanman.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: davclnt.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: davhlpr.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: | Binary string: wkernel32.pdb source: svchost.exe, 00000011.00000003.1989955906.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1990288577.00000000056A0000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wkernelbase.pdb source: svchost.exe, 00000011.00000003.1990494240.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1990665098.00000000057A0000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: ntdll.pdb source: svchost.exe, 00000011.00000003.1987255253.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1987608690.0000000005770000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wntdll.pdbUGP source: svchost.exe, 00000011.00000003.1989003267.0000000005720000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1988235306.0000000005580000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: ntdll.pdbUGP source: svchost.exe, 00000011.00000003.1987255253.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1987608690.0000000005770000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wntdll.pdb source: svchost.exe, 00000011.00000003.1989003267.0000000005720000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1988235306.0000000005580000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wkernelbase.pdbUGP source: svchost.exe, 00000011.00000003.1990494240.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1990665098.00000000057A0000.00000004.00000001.00020000.00000000.sdmp |
Source: | Binary string: wkernel32.pdbUGP source: svchost.exe, 00000011.00000003.1989955906.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1990288577.00000000056A0000.00000004.00000001.00020000.00000000.sdmp |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Code function: 0_3_007FCE7E push ebp; iretd | 0_3_007FCE7F |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Code function: 0_3_007FA667 push ebp; iretd | 0_3_007FA668 |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Code function: 0_3_007FA651 push ebp; iretd | 0_3_007FA652 |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Code function: 0_3_007FCB24 push ebp; iretd | 0_3_007FCB25 |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Code function: 0_3_007FCB0E push ebp; iretd | 0_3_007FCB0F |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Code function: 0_3_007F7904 push 66007F5Eh; ret | 0_3_007F7909 |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Code function: 0_3_007FA6B1 push ebp; iretd | 0_3_007FA6B2 |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Code function: 0_3_007FCE94 push ebp; iretd | 0_3_007FCE95 |
Source: C:\Windows\SysWOW64\svchost.exe | Code function: 17_3_03016F0F push esi; ret | 17_3_03016F21 |
Source: C:\Windows\SysWOW64\svchost.exe | Code function: 17_3_0301296C push edi; ret | 17_3_03012978 |
Source: C:\Windows\SysWOW64\svchost.exe | Code function: 17_3_03011179 push FFFFFF82h; iretd | 17_3_0301117B |
Source: C:\Windows\SysWOW64\svchost.exe | Code function: 17_3_0301437B push edi; ret | 17_3_0301434C |
Source: C:\Windows\SysWOW64\svchost.exe | Code function: 17_3_03014D81 push esi; ret | 17_3_03014DEA |
Source: C:\Windows\SysWOW64\svchost.exe | Code function: 17_3_03010FEA push eax; ret | 17_3_03010FF5 |
Source: C:\Windows\SysWOW64\svchost.exe | Code function: 17_3_0301225C push eax; ret | 17_3_0301225D |
Source: C:\Windows\SysWOW64\svchost.exe | Code function: 17_3_03012CB9 push ecx; ret | 17_3_03012CD9 |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\1E3Vcm2yrA.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\cmd.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\tasklist.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com | Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | System information queried: FirmwareTableInformation | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: VBoxGuest | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: C:\Windows\SysWOW64\vboxservice.exe | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: C:\Windows\SysWOW64\vboxtray.exe | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: C:\Windows\SysWOW64\drivers\VBoxMouse.sys | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: VBoxTrayIPC | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: C:\Windows\SysWOW64\drivers\VBoxSF.sys | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: C:\Windows\SysWOW64\vboxhook.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosDate | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: \pipe\VBoxTrayIPC | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: C:\Windows\SysWOW64\drivers\VBoxVideo.sys | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: VBoxMiniRdrDN | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | File opened / queried: C:\Windows\SysWOW64\drivers\VBoxGuest.sys | Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe | Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion | Jump to behavior |
Source: Amcache.hve.23.dr | Binary or memory string: VMware |
Source: svchost.exe, 00000011.00000002.2058295842.000000000345D000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: JMicrosoft-Windows-GPIO-ClassExtensionHMicrosoft-Windows-Hyper-V-HypervisorHMicrosoft-Antimalware-ShieldProvider>Microsoft-Windows-BitLocker-APIx.dllDMicrosoft-Windows-IsolatedUserMode@Microsoft-Windows-Kernel-General |
Source: Amcache.hve.23.dr | Binary or memory string: VMware Virtual USB Mouse |
Source: Amcache.hve.23.dr | Binary or memory string: vmci.syshbin |
Source: Amcache.hve.23.dr | Binary or memory string: VMware, Inc. |
Source: svchost.exe, 00000011.00000002.2058295842.0000000003475000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: RSVP TCP Service ProviderUASPStorUmRdpServiceusbaudio2usbehciusbserUser32VDS Basic ProviderVDS Dynamic ProviderVDS Virtual Disk ProviderVirtual Disk ServicevmcivolmgrVolsnapvpcivsmraidVSTXRAIDW32TimeWacomPenWalletServicewdf01000wecsvcWin32kWinDefendWindows Disk DiagnosticWindows Script HostWinHttpAutoProxySvcWinNatWinRMWMIxWDMWMPNetworkSvcWorkstationWPDClassInstallerC:\Windows\System32\Winevt\Logs\System.evtx2023 |
Source: svchost.exe, 00000011.00000002.2058390897.0000000003486000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: vmciVersionEnabledEnabled0 |
Source: Amcache.hve.23.dr | Binary or memory string: VMware20,1hbin@ |
Source: Amcache.hve.23.dr | Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.23.dr | Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.23.dr | Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys |
Source: svchost.exe, 00000011.00000002.2058295842.000000000345D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.2012684908.0000000003471000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: en-U>Microsoft-Windows-BitLocker-APIHMicrosoft-Windows-Devices-Background>Microsoft-Windows-DHCPv6-Client@Microsoft-Windows-EventCollectorHMicrosoft-Antimalware-ShieldProvider>Microsoft-Windows-FilterManagerJMicrosoft-Windows-GPIO-ClassExtensionHMicrosoft-Windows-Hyper-V-HypervisorDMicrosoft-Windows-IsolatedUserModeBMicrosoft-Windows-WLAN-AutoConfig>Microsoft-Windows-USB-MAUSBHOSTen-UHMicrosoft-Windows-SPB-ClassExtensionJMicrosoft-Windows-Power-Meter-Polling@Microsoft-Windows-Kernel-General>Microsoft-Windows-OverlayFilter@Microsoft-Windows-Spell-Checking>Microsoft-Windows-SetupPlatform>Microsoft-Windows-TaskScheduler<Microsoft-Windows-Kernel-PowerFMicrosoft-Windows-LanguagePackSetup<Microsoft-Windows-SpellChecker<Microsoft-Windows-OfflineFilesJMicrosoft-Windows-ResourcePublication>Microsoft-Windows-StartupRepair<Microsoft-Windows-Time-Service>Microsoft-Windows-NetworkBridgeJMicrosoft-Windows-WindowsUpdateClientBMicrosoft-Windows-WLAN-AutoConfig |
Source: svchost.exe, 00000011.00000002.2058244553.0000000003412000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V RAW |
Source: Amcache.hve.23.dr | Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.23.dr | Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev |
Source: Amcache.hve.23.dr | Binary or memory string: c:/windows/system32/drivers/vmci.sys |
Source: svchost.exe, 00000011.00000002.2058295842.0000000003475000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: rosoft-Windows-DHCPv6-ClientMicrosoft-Windows-Diagnostics-NetworkingMicrosoft-Windows-Directory-Services-SAMMicrosoft-Windows-DiskDiagnosticMicrosoft-Windows-DistributedCOMMicrosoft-Windows-DNS-ClientMicrosoft-Windows-DriverFrameworks-UserModeMicrosoft-Windows-EnhancedStorage-EhStorTcgDrvMicrosoft-Windows-EventCollectorMicrosoft-Windows-EventlogMicrosoft-Windows-exFAT-SQMMicrosoft-Windows-FailoverClustering-ClientMicrosoft-Windows-Fat-SQMMicrosoft-Windows-Fault-Tolerant-HeapMicrosoft-Windows-FilterManagerMicrosoft-Windows-FirewallMicrosoft-Windows-FMSMicrosoft-Windows-FunctionDiscoveryHostMicrosoft-Windows-GPIO-ClassExtensionMicrosoft-Windows-GroupPolicyMicrosoft-Windows-HALMicrosoft-Windows-HttpEventMicrosoft-Windows-HttpServiceMicrosoft-Windows-Hyper-V-HypervisorMicrosoft-Windows-IphlpsvcMicrosoft-Windows-IsolatedUserModeMicrosoft-Windows-Kernel-BootMicrosoft-Windows-Kernel-GeneralMicrosoft-Windows-Kernel-Interrupt-SteeringMicrosoft-Windows-Kernel-IOMicrosoft-Windows-Kernel-PnPMicrosoft-Windows-Kernel-PowerMicrosoft-Windows-Kernel-Processor-PowerMicrosoft-Windows-Kernel-TmMicrosoft-Windows-Kernel-WHEAMicrosoft-Windows-Kernel-XDVMicrosoft-Wi |
Source: Amcache.hve.23.dr | Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.23.dr | Binary or memory string: vmci.sys |
Source: Amcache.hve.23.dr | Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0 |
Source: svchost.exe, 00000011.00000003.2012596449.0000000003474000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: CorruptedFileRecovery-ClientMicrosoft-Windows-CorruptedFileRecovery-ServerMicrosoft-Windows-Devices-BackgroundMicrosoft-Windows-DfsSvcMicrosoft-Windows-Dhcp-ClientMicrosoft-Windows-DHCPv6-ClientMicrosoft-Windows-Diagnostics-NetworkingMicrosoft-Windows-Directory-Services-SAMMicrosoft-Windows-DiskDiagnosticMicrosoft-Windows-DistributedCOMMicrosoft-Windows-DNS-ClientMicrosoft-Windows-DriverFrameworks-UserModeMicrosoft-Windows-EnhancedStorage-EhStorTcgDrvMicrosoft-Windows-EventCollectorMicrosoft-Windows-EventlogMicrosoft-Windows-exFAT-SQMMicrosoft-Windows-FailoverClustering-ClientMicrosoft-Windows-Fat-SQMMicrosoft-Windows-Fault-Tolerant-HeapMicrosoft-Windows-FilterManagerMicrosoft-Windows-FirewallMicrosoft-Windows-FMSMicrosoft-Windows-FunctionDiscoveryHostMicrosoft-Windows-GPIO-ClassExtensionMicrosoft-Windows-GroupPolicyMicrosoft-Windows-HALMicrosoft-Windows-HttpEventMicrosoft-Windows-HttpServiceMicrosoft-Windows-Hyper-V-HypervisorMicrosoft-Windows-IphlpsvcMicrosoft-Windows-IsolatedUserModeMicrosoft-Windows-Kernel-BootMicrosoft-Windows-Kernel-GeneralMicrosoft-Windows-Kernel-Interrupt-SteeringMicrosoft-Windows-Kernel-IOMicrosoft-Windows-Kernel-PnPMicrosoft-Windows-Kernel-PowerMicrosoft-Windows-Kernel-Processor-PowerMicrosoft-Windows-Kernel-TmMicrosoft-Windows-Kernel-WHEAMicrosoft-Windows-Kernel-XDVMicrosoft-Windows-LanguagePackSetupMicrosoft-Windows-Memory-Diagnostic-Task-HandlerMicrosoft-Windows-MemoryDiagnostics-ResultsMicrosoft-Windows-MemoryDiagnostics-ScheduleMicrosoft-Windows-MountMgrMicrosoft-Windows-NDISMicrosoft-Windows-NdisImPlatformSysEvtProviderMicrosoft-Windows-NetworkBridgeMicrosoft-Windows-NtfsMicrosoft-Windows-Ntfs-UBPMMicrosoft-Windows-OfflineFilesMicrosoft-Windows-OverlayFilterMicrosoft-Windows-PersistentMemory-NvdimmMicrosoft-Windows-PersistentMemory-PmemDiskMicrosoft-Windows-Power-Meter-PollingMicrosoft-Windows-Power-TroubleshooterMicrosoft-Windows-ReFSMicrosoft-Windows-ReFS-v1Microsoft-Windows-ResetEngMicrosoft-Windows-Resource-Exhaustion-DetectorMicrosoft-Windows-ResourcePublicationMicrosoft-Windows-SCPNPMicrosoft-Windows-Serial-ClassExtensionMicrosoft-Windows-Serial-ClassExtension-V2Microsoft-Windows-ServicingMicrosoft-Windows-SetupMicrosoft-Windows-SetupPlatformMicrosoft-Windows-SPB-ClassExtensionMicrosoft-Windows-SPB-HIDI2CMicrosoft-Windows-Spell-CheckingMicrosoft-Windows-SpellCheckerMicrosoft-Windows-StartupRepairMicrosoft-Windows-Subsys-SMSSMicrosoft-Windows-TaskSchedulerMicrosoft-Windows-TerminalServices |