Source: explorer.exe, 00000002.00000000.1506409569.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1506409569.00000000091FB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0 |
Source: explorer.exe, 00000002.00000000.1506409569.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1506409569.00000000091FB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07 |
Source: explorer.exe, 00000002.00000000.1506409569.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1506409569.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1506409569.00000000091FB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0 |
Source: explorer.exe, 00000002.00000000.1504585767.0000000004405000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://ns.adobeS |
Source: explorer.exe, 00000002.00000000.1506409569.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1506409569.00000000091FB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.com0 |
Source: explorer.exe, 00000002.00000000.1506409569.00000000090DA000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di |
Source: explorer.exe, 00000002.00000000.1504054456.0000000002C80000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1505677351.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1505690894.0000000007720000.00000002.00000001.00040000.00000000.sdmp | String found in binary or memory: http://schemas.micro |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://www.autoitscript.com/autoit3/J |
Source: explorer.exe, 00000002.00000000.1506409569.0000000009237000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://www.microsoft.c |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BC80000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BC80000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://android.notify.windows.com/iOS |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BC80000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://android.notify.windows.com/iOSA4 |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BC80000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://android.notify.windows.com/iOSd |
Source: explorer.exe, 00000002.00000000.1504995292.000000000702D000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/ |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind |
Source: explorer.exe, 00000002.00000000.1506409569.00000000090DA000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows? |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1506409569.00000000091FB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows? |
Source: explorer.exe, 00000002.00000000.1506409569.00000000091FB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://arc.msn.com |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi |
Source: explorer.exe, 0000000B.00000002.2429108620.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2429108620.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2429108620.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/ |
Source: explorer.exe, 0000000B.00000002.2429108620.0000000000D58000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/WN/ |
Source: explorer.exe, 0000000B.00000002.2429108620.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/application/x-www-form-urlencodedMozilla/5.0 |
Source: explorer.exe, 0000000B.00000002.2429108620.0000000000D81000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/earch.php |
Source: explorer.exe, 0000000B.00000002.2429108620.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2429108620.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2385078500.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3874970360.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3874368668.00000000006C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3874757842.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.3873766554.0000000000E29000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/search.php |
Source: explorer.exe, 0000000B.00000002.2429108620.0000000000D81000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/search.php= |
Source: explorer.exe, 0000000B.00000002.2429108620.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2385078500.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3874970360.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3874368668.00000000006C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3874757842.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.3873766554.0000000000E29000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/search.phpMozilla/5.0 |
Source: explorer.exe, 0000000B.00000002.2429108620.0000000000D93000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com:443/search.phpt |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://excel.office.com |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BC80000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://java.co |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://outlook.com |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://powerpoint.office.comer |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://wns.windows.com/EM0 |
Source: explorer.exe, 00000002.00000000.1508355661.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://word.office.com48 |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: explorer.exe, 0000000B.00000003.2401255932.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, EE52.tmp.11.dr | String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1 |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/ |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09 |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt |
Source: explorer.exe, 00000002.00000000.1504995292.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com:443/en-us/feed |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00401514 EntryPoint,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401514 |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00402F97 RtlCreateUserThread,NtTerminateProcess, | 0_2_00402F97 |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401542 |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00403247 NtTerminateProcess,RtlInitUnicodeString, | 0_2_00403247 |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401549 |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_0040324F NtTerminateProcess,RtlInitUnicodeString, | 0_2_0040324F |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00403256 NtTerminateProcess,RtlInitUnicodeString, | 0_2_00403256 |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401557 |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_0040326C NtTerminateProcess,RtlInitUnicodeString, | 0_2_0040326C |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00403277 NtTerminateProcess,RtlInitUnicodeString, | 0_2_00403277 |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_0040327D NtTerminateProcess,RtlInitUnicodeString, | 0_2_0040327D |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_004014FE |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Code function: 0_2_00403290 NtTerminateProcess,RtlInitUnicodeString, | 0_2_00403290 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00401514 EntryPoint,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 4_2_00401514 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00402F97 RtlCreateUserThread,NtTerminateProcess, | 4_2_00402F97 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 4_2_00401542 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00403247 NtTerminateProcess,RtlInitUnicodeString, | 4_2_00403247 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 4_2_00401549 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_0040324F NtTerminateProcess,RtlInitUnicodeString, | 4_2_0040324F |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00403256 NtTerminateProcess,RtlInitUnicodeString, | 4_2_00403256 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 4_2_00401557 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_0040326C NtTerminateProcess,RtlInitUnicodeString, | 4_2_0040326C |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00403277 NtTerminateProcess,RtlInitUnicodeString, | 4_2_00403277 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_0040327D NtTerminateProcess,RtlInitUnicodeString, | 4_2_0040327D |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_004032C7 ExpandEnvironmentStringsW,CreateFileW,CreateFileMappingW,MapViewOfFile,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower, | 4_2_004032C7 |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 4_2_004014FE |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Code function: 4_2_00403290 NtTerminateProcess,RtlInitUnicodeString, | 4_2_00403290 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_00403043 RtlCreateUserThread,NtTerminateProcess, | 7_2_00403043 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004014C4 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 7_2_004014C4 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_00401508 NtAllocateVirtualMemory, | 7_2_00401508 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004014CF NtAllocateVirtualMemory, | 7_2_004014CF |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004015D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 7_2_004015D5 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004014DE NtAllocateVirtualMemory, | 7_2_004014DE |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004015DF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 7_2_004015DF |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004015E6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 7_2_004015E6 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004015F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 7_2_004015F2 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004014F5 NtAllocateVirtualMemory, | 7_2_004014F5 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004014F8 NtAllocateVirtualMemory, | 7_2_004014F8 |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Code function: 7_2_004014FB NtAllocateVirtualMemory, | 7_2_004014FB |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_00403043 RtlCreateUserThread,NtTerminateProcess, | 8_2_00403043 |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004014C4 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004014C4 |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_00401508 NtAllocateVirtualMemory, | 8_2_00401508 |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004014CF NtAllocateVirtualMemory, | 8_2_004014CF |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004015D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004015D5 |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004014DE NtAllocateVirtualMemory, | 8_2_004014DE |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004015DF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004015DF |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004015E6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004015E6 |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004015F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004015F2 |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004014F5 NtAllocateVirtualMemory, | 8_2_004014F5 |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004014F8 NtAllocateVirtualMemory, | 8_2_004014F8 |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Code function: 8_2_004014FB NtAllocateVirtualMemory, | 8_2_004014FB |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 11_2_00C34B92 RtlMoveMemory,NtUnmapViewOfSection, | 11_2_00C34B92 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 11_2_00C333C3 NtQueryInformationFile, | 11_2_00C333C3 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 11_2_00C3349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle, | 11_2_00C3349B |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 11_2_00C3342B NtQueryObject,NtQueryObject,RtlMoveMemory, | 11_2_00C3342B |
Source: C:\Windows\explorer.exe | Code function: 13_2_00D338B0 NtUnmapViewOfSection, | 13_2_00D338B0 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 14_2_00C21016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, | 14_2_00C21016 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 14_2_00C21A80 NtCreateSection,NtMapViewOfSection, | 14_2_00C21A80 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 14_2_00C21819 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, | 14_2_00C21819 |
Source: C:\Windows\explorer.exe | Code function: 15_2_0035355C NtUnmapViewOfSection, | 15_2_0035355C |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_00AD1016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, | 16_2_00AD1016 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_00AD1B26 NtCreateSection,NtMapViewOfSection, | 16_2_00AD1B26 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_00AD18BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, | 16_2_00AD18BF |
Source: C:\Windows\explorer.exe | Code function: 17_2_00E0370C NtUnmapViewOfSection, | 17_2_00E0370C |
Source: unknown | Process created: C:\Users\user\Desktop\OCYe9qcxiM.exe "C:\Users\user\Desktop\OCYe9qcxiM.exe" | |
Source: unknown | Process created: C:\Users\user\AppData\Roaming\hehcrfb C:\Users\user\AppData\Roaming\hehcrfb | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\4470.exe C:\Users\user\AppData\Local\Temp\4470.exe | |
Source: unknown | Process created: C:\Users\user\AppData\Roaming\fihcrfb C:\Users\user\AppData\Roaming\fihcrfb | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\354F.exe C:\Users\user\AppData\Local\Temp\354F.exe | |
Source: unknown | Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Process created: C:\Windows\System32\cmd.exe cmd | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv | |
Source: unknown | Process created: C:\Users\user\AppData\Roaming\hehcrfb C:\Users\user\AppData\Roaming\hehcrfb | |
Source: unknown | Process created: C:\Users\user\AppData\Roaming\fihcrfb C:\Users\user\AppData\Roaming\fihcrfb | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ROUTE.EXE route print | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\netsh.exe netsh firewall show state | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\systeminfo.exe systeminfo | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\4470.exe C:\Users\user\AppData\Local\Temp\4470.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\354F.exe C:\Users\user\AppData\Local\Temp\354F.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Process created: C:\Windows\System32\cmd.exe cmd | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ROUTE.EXE route print | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\netsh.exe netsh firewall show state | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\systeminfo.exe systeminfo | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv | |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\Desktop\OCYe9qcxiM.exe | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: taskschd.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: webio.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: mfsrcsnk.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: vcruntime140_1.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: vcruntime140.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: msvcp140.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: vcruntime140.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: mfsrcsnk.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\hehcrfb | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\4470.exe | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\fihcrfb | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: winscard.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: devobj.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: cryptnet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\354F.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: aclayers.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: sfc.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: msi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: vaultcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dhcpcsvc6.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dhcpcsvc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ondemandconnroutehelper.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: webio.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winnsi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: rasadhlp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: fwpuclnt.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: schannel.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: mskeyprotect.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ncryptsslp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | |
Source: C:\Windows\System32\cmd.exe | Section loaded: winbrand.dll | |
Source: C:\Windows\System32\cmd.exe | Section loaded: wldp.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dhcpcsvc.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dhcpcsvc6.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dhcpcsvc6.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dhcpcsvc.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dnsapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: ifmon.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: mprapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasmontr.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasapi32.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: fwpuclnt.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasman.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: mfc42u.dll | |