Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0 |
Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07 |
Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0 |
Source: explorer.exe, 00000002.00000000.2219404532.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.com0 |
Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di |
Source: explorer.exe, 00000002.00000000.2218524683.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2216870595.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2218534895.0000000007B60000.00000002.00000001.00040000.00000000.sdmp | String found in binary or memory: http://schemas.micro |
Source: explorer.exe, 00000002.00000000.2222332214.000000000C36B000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://www.autoitscript.com/autoit3/J |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: explorer.exe, 00000002.00000000.2219776484.00000000099AB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp |
Source: explorer.exe, 00000002.00000000.2222332214.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://android.notify.windows.com/iOS |
Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/ |
Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/I |
Source: explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind |
Source: explorer.exe, 00000002.00000000.2219404532.000000000962B000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows? |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows? |
Source: explorer.exe, 00000002.00000000.2219404532.000000000973C000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://arc.msn.com |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://excel.office.com- |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img |
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3226508578.0000000002ABB000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ninjahallnews.com/ |
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ninjahallnews.com// |
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ninjahallnews.com/application/x-www-form-urlencodedMozilla/5.0 |
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A60000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ninjahallnews.com/earch.php;L |
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3175208514.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4580797896.00000000031C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4580427782.0000000000949000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4580422286.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4580424413.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ninjahallnews.com/search.php |
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3175208514.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4580797896.00000000031C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.4580427782.0000000000949000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.4580422286.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.4580424413.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ninjahallnews.com/search.phpMozilla/5.0 |
Source: explorer.exe, 0000000D.00000002.3226508578.0000000002A60000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ninjahallnews.com/search.phpo |
Source: explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://outlook.come |
Source: explorer.exe, 00000002.00000000.2222332214.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://powerpoint.office.comEMd |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew |
Source: explorer.exe, 00000002.00000000.2219776484.00000000099AB000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://wns.windows.com/e |
Source: explorer.exe, 00000002.00000000.2222332214.000000000C048000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://word.office.comM |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: explorer.exe, 0000000D.00000003.3197507522.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, 98A5.tmp.13.dr | String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar- |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its- |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized- |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of- |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve |
Source: explorer.exe, 00000002.00000000.2218006432.00000000073E5000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: https://www.msn.com:443/en-us/feed |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401514 |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_00402F97 RtlCreateUserThread,NtTerminateProcess, | 0_2_00402F97 |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401542 |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_00403247 NtTerminateProcess,GetModuleHandleA, | 0_2_00403247 |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401549 |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_0040324F NtTerminateProcess,GetModuleHandleA, | 0_2_0040324F |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_00403256 NtTerminateProcess,GetModuleHandleA, | 0_2_00403256 |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_00401557 |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_0040326C NtTerminateProcess,GetModuleHandleA, | 0_2_0040326C |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_0040327D NtTerminateProcess,GetModuleHandleA, | 0_2_0040327D |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 0_2_004014FE |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Code function: 0_2_00403290 NtTerminateProcess,GetModuleHandleA, | 0_2_00403290 |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_00401514 |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_00402F97 RtlCreateUserThread,NtTerminateProcess, | 6_2_00402F97 |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_00401542 |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_00403247 NtTerminateProcess,GetModuleHandleA, | 6_2_00403247 |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_00401549 |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_0040324F NtTerminateProcess,GetModuleHandleA, | 6_2_0040324F |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_00403256 NtTerminateProcess,GetModuleHandleA, | 6_2_00403256 |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_00401557 |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_0040326C NtTerminateProcess,GetModuleHandleA, | 6_2_0040326C |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_0040327D NtTerminateProcess,GetModuleHandleA, | 6_2_0040327D |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 6_2_004014FE |
Source: C:\Users\user\AppData\Roaming\jvgasii | Code function: 6_2_00403290 NtTerminateProcess,GetModuleHandleA, | 6_2_00403290 |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_00403103 RtlCreateUserThread,NtTerminateProcess, | 9_2_00403103 |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_004014FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 9_2_004014FB |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_00401641 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 9_2_00401641 |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_00403257 RtlCreateUserThread,NtTerminateProcess, | 9_2_00403257 |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_00401606 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 9_2_00401606 |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_00401613 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 9_2_00401613 |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_00401627 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 9_2_00401627 |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_00403433 GetKeyboardLayoutList,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,towlower, | 9_2_00403433 |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Code function: 9_2_004015FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 9_2_004015FB |
Source: C:\Users\user\AppData\Roaming\uegasii | Code function: 10_2_00403103 RtlCreateUserThread,NtTerminateProcess, | 10_2_00403103 |
Source: C:\Users\user\AppData\Roaming\uegasii | Code function: 10_2_004014FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 10_2_004014FB |
Source: C:\Users\user\AppData\Roaming\uegasii | Code function: 10_2_00401641 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 10_2_00401641 |
Source: C:\Users\user\AppData\Roaming\uegasii | Code function: 10_2_00403257 RtlCreateUserThread,NtTerminateProcess, | 10_2_00403257 |
Source: C:\Users\user\AppData\Roaming\uegasii | Code function: 10_2_00401606 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 10_2_00401606 |
Source: C:\Users\user\AppData\Roaming\uegasii | Code function: 10_2_00401613 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 10_2_00401613 |
Source: C:\Users\user\AppData\Roaming\uegasii | Code function: 10_2_00401627 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 10_2_00401627 |
Source: C:\Users\user\AppData\Roaming\uegasii | Code function: 10_2_004015FB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, | 10_2_004015FB |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 13_2_00434B92 RtlMoveMemory,NtUnmapViewOfSection, | 13_2_00434B92 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 13_2_004333C3 NtQueryInformationFile, | 13_2_004333C3 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 13_2_0043342B NtQueryObject,NtQueryObject,RtlMoveMemory, | 13_2_0043342B |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 13_2_0043349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle, | 13_2_0043349B |
Source: C:\Windows\explorer.exe | Code function: 15_2_00E338B0 NtUnmapViewOfSection, | 15_2_00E338B0 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_02F01016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpiA,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, | 16_2_02F01016 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_02F01819 lstrcmpiA,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, | 16_2_02F01819 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 16_2_02F01A80 NtCreateSection,NtMapViewOfSection, | 16_2_02F01A80 |
Source: C:\Windows\explorer.exe | Code function: 17_2_005C355C NtUnmapViewOfSection, | 17_2_005C355C |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 18_2_00471016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpiA,lstrcmpiA,Process32Next,CloseHandle,Sleep, | 18_2_00471016 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 18_2_00471B26 NtCreateSection,NtMapViewOfSection, | 18_2_00471B26 |
Source: C:\Windows\SysWOW64\explorer.exe | Code function: 18_2_004718BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, | 18_2_004718BF |
Source: C:\Windows\explorer.exe | Code function: 19_2_00AA370C NtUnmapViewOfSection, | 19_2_00AA370C |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process |
Source: C:\Windows\System32\wbem\WMIC.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, DeviceID, NumberOfCores FROM Win32_Processor |
Source: C:\Windows\System32\wbem\WMIC.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, CommandLine, ExecutablePath, ProcessId FROM Win32_Process |
Source: C:\Windows\System32\systeminfo.exe | WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor |
Source: C:\Windows\System32\systeminfo.exe | WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="92"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="92"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="328"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="328"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="412"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="412"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="488"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="488"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="496"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="496"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="560"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="560"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="632"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="632"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="652"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="652"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="752"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="752"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="780"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="780"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="788"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="788"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="868"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="868"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="928"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="928"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="996"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="996"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="436"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="436"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="376"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="376"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="60"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="60"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="980"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="980"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1040"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1040"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1064"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1064"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1140"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1140"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1192"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1192"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1248"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1248"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1328"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1328"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1344"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1344"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1356"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1356"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1448"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1448"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1496"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1496"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1516"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1516"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1528"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1528"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1560"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1560"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1640"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1640"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1648"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1648"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1784"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1784"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1872"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1872"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1900"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1900"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1980"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1980"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1988"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1988"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2000"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2000"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1704"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1704"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2076"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2076"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2088"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2088"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2148"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2148"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2236"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2236"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2288"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2288"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2412"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2412"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2424"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2424"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2516"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2516"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2552"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2552"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2560"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2560"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2600"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2600"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2624"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2624"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2648"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2648"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2692"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2692"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2764"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2764"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2916"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="2916"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3008"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3008"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3624"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3624"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3668"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3668"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3808"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3808"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3952"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3952"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4168"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4168"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4356"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4356"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4400"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="4400"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5416"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5416"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6016"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6016"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5428"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5428"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1888"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="1888"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5312"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="5312"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6296"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="6296"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3108"::GetOwner |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle="3108"::GetOwner |
Source: unknown | Process created: C:\Users\user\Desktop\O4zPA1oI9Y.exe "C:\Users\user\Desktop\O4zPA1oI9Y.exe" | |
Source: unknown | Process created: C:\Users\user\AppData\Roaming\jvgasii C:\Users\user\AppData\Roaming\jvgasii | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\DE97.exe C:\Users\user\AppData\Local\Temp\DE97.exe | |
Source: unknown | Process created: C:\Users\user\AppData\Roaming\uegasii C:\Users\user\AppData\Roaming\uegasii | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\8CAE.exe C:\Users\user\AppData\Local\Temp\8CAE.exe | |
Source: unknown | Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Process created: C:\Windows\System32\cmd.exe cmd | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ROUTE.EXE route print | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\netsh.exe netsh firewall show state | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\systeminfo.exe systeminfo | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv | |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\DE97.exe C:\Users\user\AppData\Local\Temp\DE97.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Users\user\AppData\Local\Temp\8CAE.exe C:\Users\user\AppData\Local\Temp\8CAE.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe | Jump to behavior |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Process created: C:\Windows\System32\cmd.exe cmd | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ipconfig.exe ipconfig /displaydns | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\ROUTE.EXE route print | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\netsh.exe netsh firewall show state | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\systeminfo.exe systeminfo | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /v /fo csv | |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\Desktop\O4zPA1oI9Y.exe | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.cloudstore.schema.shell.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: taskschd.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: webio.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.internal.shell.broker.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\jvgasii | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\jvgasii | Section loaded: msimg32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\jvgasii | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Section loaded: nejupazabujicojoxalajahi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\DE97.exe | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\uegasii | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\uegasii | Section loaded: nejupazabujicojoxalajahi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Roaming\uegasii | Section loaded: msvcr100.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: winscard.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: devobj.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: cryptnet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\8CAE.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: aclayers.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: sfc.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\msiexec.exe | Section loaded: msi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: vaultcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dhcpcsvc6.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dhcpcsvc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ondemandconnroutehelper.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: webio.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: mswsock.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winnsi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: fwpuclnt.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: rasadhlp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: schannel.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: mskeyprotect.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntasn1.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ncrypt.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ncryptsslp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: gpapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: aepic.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: powrprof.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dxgi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wtsapi32.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: twinapi.appcore.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: umpdc.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: dnsapi.dll | Jump to behavior |
Source: C:\Windows\SysWOW64\explorer.exe | Section loaded: winhttp.dll | Jump to behavior |
Source: C:\Windows\explorer.exe | Section loaded: aepic.dll | |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: userenv.dll | |
Source: C:\Windows\explorer.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: powrprof.dll | |
Source: C:\Windows\explorer.exe | Section loaded: ntmarta.dll | |
Source: C:\Windows\explorer.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wldp.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dxgi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: propsys.dll | |
Source: C:\Windows\explorer.exe | Section loaded: coremessaging.dll | |
Source: C:\Windows\explorer.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\explorer.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\explorer.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\explorer.exe | Section loaded: netutils.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wtsapi32.dll | |
Source: C:\Windows\explorer.exe | Section loaded: wininet.dll | |
Source: C:\Windows\explorer.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dwmapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\explorer.exe | Section loaded: twinapi.appcore.dll | |
Source: C:\Windows\explorer.exe | Section loaded: umpdc.dll | |
Source: C:\Windows\explorer.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\explorer.exe | Section loaded: winhttp.dll | |
Source: C:\Windows\System32\cmd.exe | Section loaded: winbrand.dll | |
Source: C:\Windows\System32\cmd.exe | Section loaded: wldp.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: msxml6.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: vcruntime140_1.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wbem\WMIC.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dhcpcsvc.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dhcpcsvc6.dll | |
Source: C:\Windows\System32\ipconfig.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dhcpcsvc6.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dhcpcsvc.dll | |
Source: C:\Windows\System32\ROUTE.EXE | Section loaded: dnsapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: ifmon.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: iphlpapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: mprapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasmontr.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasapi32.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: fwpuclnt.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasman.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: mfc42u.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: rasman.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: authfwcfg.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: fwpolicyiomgr.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: firewallapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: dnsapi.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: fwbase.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: dhcpcmonitor.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: dot3cfg.dll | |
Source: C:\Windows\System32\netsh.exe | Section loaded: dot3api.dll | |