Source: explorer.exe, 00000001.00000000.1762089358.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1763817484.000000000982D000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0 |
Source: explorer.exe, 00000001.00000000.1762089358.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1763817484.000000000982D000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07 |
Source: explorer.exe, 00000001.00000000.1762089358.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1763817484.000000000982D000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0 |
Source: explorer.exe, 00000001.00000000.1762089358.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1763817484.000000000982D000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.com0 |
Source: explorer.exe, 00000001.00000000.1762089358.00000000078AD000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di |
Source: explorer.exe, 00000001.00000000.1764575122.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1763344774.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1762910279.0000000007F40000.00000002.00000001.00040000.00000000.sdmp | String found in binary or memory: http://schemas.micro |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: explorer.exe, 00000001.00000000.1765842009.000000000C893000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe |
Source: explorer.exe, 00000001.00000000.1762089358.00000000079FB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://aka.ms/Vh5j3k |
Source: explorer.exe, 00000001.00000000.1762089358.00000000079FB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://aka.ms/odirmr |
Source: explorer.exe, 00000001.00000000.1765842009.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://android.notify.windows.com/iOS |
Source: explorer.exe, 00000001.00000000.1763817484.00000000097D4000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/ |
Source: explorer.exe, 00000001.00000000.1763817484.00000000097D4000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/q |
Source: explorer.exe, 00000001.00000000.1761280775.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1760642789.0000000001240000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind |
Source: explorer.exe, 00000001.00000000.1763817484.00000000096DF000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?& |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1763817484.00000000097D4000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows? |
Source: explorer.exe, 00000001.00000000.1763817484.00000000096DF000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://arc.msn.comi |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg |
Source: explorer.exe, 0000000B.00000002.2707106638.0000000000980000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2707106638.00000000009E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2707106638.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/ |
Source: explorer.exe, 0000000B.00000002.2707106638.0000000000980000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/5 |
Source: explorer.exe, 0000000B.00000002.2707106638.00000000009E6000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/application/x-www-form-urlencodedMozilla/5.0 |
Source: explorer.exe, 0000000B.00000002.2707106638.00000000009E2000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/earch.php |
Source: explorer.exe, 0000000B.00000002.2707106638.0000000000980000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/p |
Source: explorer.exe, 0000000B.00000002.2707106638.0000000000980000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2667025183.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4176755346.00000000036B7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4176575408.0000000001318000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4176400478.0000000000827000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.4176402726.00000000013C8000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/search.php |
Source: explorer.exe, 0000000B.00000002.2707106638.0000000000980000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2667025183.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4176755346.00000000036B7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4176575408.0000000001318000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4176400478.0000000000827000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.4176402726.00000000013C8000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://calvinandhalls.com/search.phpMozilla/5.0 |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark |
Source: explorer.exe, 00000001.00000000.1762089358.00000000078AD000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu |
Source: explorer.exe, 00000001.00000000.1762089358.00000000078AD000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: explorer.exe, 00000001.00000000.1765842009.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://excel.office.com |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img |
Source: explorer.exe, 00000001.00000000.1762089358.00000000078AD000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img |
Source: explorer.exe, 00000001.00000000.1765842009.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://outlook.com_ |
Source: explorer.exe, 00000001.00000000.1765842009.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://powerpoint.office.comcember |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/ |
Source: 451E.exe, 00000009.00000003.4168022466.000002E004F29000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://support.moz |
Source: 451E.exe, 00000009.00000003.4168022466.000002E004F22000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://support.mozilla.org |
Source: 451E.exe, 00000009.00000002.4176613175.000002E002DCC000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br |
Source: 451E.exe, 00000009.00000002.4176613175.000002E002E1E000.00000004.00000020.00020000.00000000.sdmp, 451E.exe, 00000009.00000003.4155384339.000002E004C26000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 |
Source: 451E.exe, 00000009.00000003.4155384339.000002E004C02000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples |
Source: 451E.exe, 00000009.00000002.4177703163.000002E002E77000.00000004.00000020.00020000.00000000.sdmp, 451E.exe, 00000009.00000003.4155384339.000002E004C26000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 |
Source: 451E.exe, 00000009.00000003.4155384339.000002E004C02000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install |
Source: 451E.exe, 00000009.00000002.4177606675.000002E002E44000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17pot |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew |
Source: explorer.exe, 00000001.00000000.1765842009.000000000C557000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://wns.windows.com/L |
Source: explorer.exe, 00000001.00000000.1765842009.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://word.office.com |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: explorer.exe, 0000000B.00000003.2680145906.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, A4FF.tmp.11.dr | String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: 451E.exe, 00000009.00000003.4168022466.000002E004F22000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.mozilla.org |
Source: 451E.exe, 00000009.00000003.4168022466.000002E004F29000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2 |
Source: 451E.exe, 00000009.00000003.4168022466.000002E004F29000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR |
Source: 451E.exe, 00000009.00000003.4168022466.000002E004F29000.00000004.00000020.00020000.00000000.sdmp, 451E.exe, 00000009.00000002.4177703163.000002E002E77000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox |
Source: 451E.exe, 00000009.00000002.4176613175.000002E002E1E000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig |
Source: 451E.exe, 00000009.00000003.4168022466.000002E004F29000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www. |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1 |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1762089358.00000000078AD000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re- |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow- |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar |
Source: explorer.exe, 00000001.00000000.1762089358.00000000078AD000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com:443/en-us/feed |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/ |
Source: explorer.exe, 00000001.00000000.1762089358.0000000007900000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401514 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00402F97 RtlCreateUserThread,NtTerminateProcess, | 0_2_00402F97 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401542 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00403247 NtTerminateProcess,GetModuleHandleA, | 0_2_00403247 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401549 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_0040324F NtTerminateProcess,GetModuleHandleA, | 0_2_0040324F |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00403256 NtTerminateProcess,GetModuleHandleA, | 0_2_00403256 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401557 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_0040326C NtTerminateProcess,GetModuleHandleA, | 0_2_0040326C |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00403277 NtTerminateProcess,GetModuleHandleA, | 0_2_00403277 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_004032C7 CreateFileW,GetForegroundWindow,NtEnumerateKey,wcsstr, | 0_2_004032C7 |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_004014FE |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Code function: 0_2_00403290 NtTerminateProcess,GetModuleHandleA, | 0_2_00403290 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 5_2_00401514 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00402F97 RtlCreateUserThread,NtTerminateProcess, | 5_2_00402F97 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 5_2_00401542 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00403247 NtTerminateProcess,GetModuleHandleA, | 5_2_00403247 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 5_2_00401549 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_0040324F NtTerminateProcess,GetModuleHandleA, | 5_2_0040324F |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00403256 NtTerminateProcess,GetModuleHandleA, | 5_2_00403256 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 5_2_00401557 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_0040326C NtTerminateProcess,GetModuleHandleA, | 5_2_0040326C |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00403277 NtTerminateProcess,GetModuleHandleA, | 5_2_00403277 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_004032C7 CreateFileW,GetForegroundWindow,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,wcsstr,tolower,towlower, | 5_2_004032C7 |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 5_2_004014FE |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Code function: 5_2_00403290 NtTerminateProcess,GetModuleHandleA, | 5_2_00403290 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_00403043 RtlCreateUserThread,NtTerminateProcess, | 6_2_00403043 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004014C4 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_004014C4 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_00401508 NtAllocateVirtualMemory, | 6_2_00401508 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004014CF NtAllocateVirtualMemory, | 6_2_004014CF |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004015D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_004015D5 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004014DE NtAllocateVirtualMemory, | 6_2_004014DE |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004015DF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_004015DF |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004015E6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_004015E6 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004015F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_004015F2 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004014F5 NtAllocateVirtualMemory, | 6_2_004014F5 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004014F8 NtAllocateVirtualMemory, | 6_2_004014F8 |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Code function: 6_2_004014FB NtAllocateVirtualMemory, | 6_2_004014FB |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_00403043 RtlCreateUserThread,NtTerminateProcess, | 8_2_00403043 |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004014C4 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004014C4 |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_00401508 NtAllocateVirtualMemory, | 8_2_00401508 |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004014CF NtAllocateVirtualMemory, | 8_2_004014CF |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004015D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004015D5 |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004014DE NtAllocateVirtualMemory, | 8_2_004014DE |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004015DF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004015DF |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004015E6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004015E6 |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004015F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 8_2_004015F2 |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004014F5 NtAllocateVirtualMemory, | 8_2_004014F5 |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004014F8 NtAllocateVirtualMemory, | 8_2_004014F8 |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Code function: 8_2_004014FB NtAllocateVirtualMemory, | 8_2_004014FB |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 11_2_00804B92 RtlMoveMemory,NtUnmapViewOfSection, | 11_2_00804B92 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 11_2_008033C3 NtQueryInformationFile, | 11_2_008033C3 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 11_2_0080349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle, | 11_2_0080349B |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 11_2_0080342B NtQueryObject,NtQueryObject,RtlMoveMemory, | 11_2_0080342B |
Source: C:\Windows\explorer.exe | Code function: 14_2_00C838B0 NtUnmapViewOfSection, | 14_2_00C838B0 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_034A1016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, | 16_2_034A1016 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_034A1A80 NtCreateSection,NtMapViewOfSection, | 16_2_034A1A80 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_034A1819 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, | 16_2_034A1819 |
Source: C:\Windows\explorer.exe | Code function: 17_2_00F6355C NtUnmapViewOfSection, | 17_2_00F6355C |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 19_2_00551016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, | 19_2_00551016 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 19_2_005518BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, | 19_2_005518BF |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 19_2_00551B26 NtCreateSection,NtMapViewOfSection, | 19_2_00551B26 |
Source: C:\Windows\explorer.exe | Code function: 21_2_00FC370C NtUnmapViewOfSection, | 21_2_00FC370C |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process |
Source: C:\Windows\System32\wbem\WMIC.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor |
Source: C:\Windows\System32\wbem\WMIC.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, CommandLine, ExecutablePath, ProcessId FROM Win32_Process |
Source: C:\Windows\System32\systeminfo.exe | WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor |
Source: C:\Windows\System32\systeminfo.exe | WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="92"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="324"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="408"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="484"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="492"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="552"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="620"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="628"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="752"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="776"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="784"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="872"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="920"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="988"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="364"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="356"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="696"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="592"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1044"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1084"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1176"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1200"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1252"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1296"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1316"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1408"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1476"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1488"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1496"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1552"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1572"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1652"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1724"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1824"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1840"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1940"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1948"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1956"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2036"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1932"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2064"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2152"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2216"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2268"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2388"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2396"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2508"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2528"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2552"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2608"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2616"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2624"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2632"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2748"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2900"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2012"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3304"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3536"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3768"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3816"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4032"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2544"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3404"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5108"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5484"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5704"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5860"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4920"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1328"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4584"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1744"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2364"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="564"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1836"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2412"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6720"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6940"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6496"::GetOwner |
Source: unknown | Process created: C:\Users\user\Desktop\v173TV3V11.exe "C:\Users\user\Desktop\v173TV3V11.exe" | |
Source: unknown | Process created: C:\Users\user\AppData\Roaming\bsjhhuh C:\Users\user\AppData\Roaming\bsjhhuh | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\C35.exe C:\Users\user\AppData\Local\Temp\C35.exe | |
Source: unknown | Process created: C:\Users\user\AppData\Roaming\vejhhuh C:\Users\user\AppData\Roaming\vejhhuh | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\451E.exe C:\Users\user\AppData\Local\Temp\451E.exe | |
Source: unknown | Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Process created: C:\Windows\System32\cmd.exe cmd | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ROUTE.EXE route print | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\netsh.exe netsh firewall show state | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\systeminfo.exe systeminfo | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\net.exe net accounts /domain | |
Source: C:\Windows\System32\net.exe | Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 accounts /domain | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\net.exe net share | |
Source: C:\Windows\System32\net.exe | Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 share | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\net.exe net user | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\C35.exe C:\Users\user\AppData\Local\Temp\C35.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\451E.exe C:\Users\user\AppData\Local\Temp\451E.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Process created: C:\Windows\System32\cmd.exe cmd | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ROUTE.EXE route print | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\netsh.exe netsh firewall show state | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\systeminfo.exe systeminfo | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\net.exe net accounts /domain | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\net.exe net share | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\net.exe net user | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\net.exe | Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 accounts /domain | |
Source: C:\Windows\System32\net.exe | Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 share | |
Source: C:\Windows\System32\net.exe | Process created: unknown unknown | |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\Desktop\v173TV3V11.exe | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: taskschd.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: webio.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: mfsrcsnk.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: vcruntime140_1.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: vcruntime140.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: msvcp140.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: vcruntime140.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\bsjhhuh | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\C35.exe | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\vejhhuh | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: winscard.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: devobj.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: cryptnet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: winsta.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: ieframe.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: netapi32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: wkscli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\451E.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: aclayers.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: sfc.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: msi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: vaultcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dhcpcsvc6.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dhcpcsvc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ondemandconnroutehelper.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: webio.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winnsi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: fwpuclnt.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: rasadhlp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: schannel.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: mskeyprotect.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ncryptsslp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: winbrand.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dhcpcsvc.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dhcpcsvc6.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dhcpcsvc6.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dhcpcsvc.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dnsapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: ifmon.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: mprapi.dll | |