Source: |
Binary string: wextract.pdb source: file.exe |
Source: |
Binary string: wextract.pdbGCTL source: file.exe |
Source: |
Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: computerlead.exe, 00000001.00000002.2938052510.00000000056B0000.00000004.08000000.00040000.00000000.sdmp |
Source: |
Binary string: wkernel32.pdb source: fontdrvhost.exe, 00000012.00000003.2945316096.0000000004C00000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2945134717.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wkernelbase.pdb source: fontdrvhost.exe, 00000012.00000003.2945665948.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2946060481.0000000004D00000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: ntdll.pdb source: fontdrvhost.exe, 00000012.00000003.2943041755.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2943531107.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdbUGP source: fontdrvhost.exe, 00000012.00000003.2944071441.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2944366502.0000000004C80000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: ntdll.pdbUGP source: fontdrvhost.exe, 00000012.00000003.2943041755.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2943531107.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: fontdrvhost.exe, 00000012.00000003.2944071441.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2944366502.0000000004C80000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wkernel32.pdbUGP source: fontdrvhost.exe, 00000012.00000003.2945316096.0000000004C00000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2945134717.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wkernelbase.pdbUGP source: fontdrvhost.exe, 00000012.00000003.2945665948.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2946060481.0000000004D00000.00000004.00000001.00020000.00000000.sdmp |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 104.37.175.218 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E05810 |
0_2_00007FF7E5E05810 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E01A08 |
0_2_00007FF7E5E01A08 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E04BE0 |
0_2_00007FF7E5E04BE0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E05B50 |
0_2_00007FF7E5E05B50 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E0521C |
0_2_00007FF7E5E0521C |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E0721C |
0_2_00007FF7E5E0721C |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E04BDE |
0_2_00007FF7E5E04BDE |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E033BC |
0_2_00007FF7E5E033BC |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00007FF7E5E078AE |
0_2_00007FF7E5E078AE |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_018046A0 |
1_2_018046A0 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_031B0DB0 |
1_2_031B0DB0 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_031B2F40 |
1_2_031B2F40 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799D798 |
1_2_0799D798 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799C700 |
1_2_0799C700 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799EC30 |
1_2_0799EC30 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_07990460 |
1_2_07990460 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799E3A8 |
1_2_0799E3A8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_07990929 |
1_2_07990929 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799D787 |
1_2_0799D787 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799EF70 |
1_2_0799EF70 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_07993690 |
1_2_07993690 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799C6F9 |
1_2_0799C6F9 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_07993679 |
1_2_07993679 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799EC20 |
1_2_0799EC20 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_07998448 |
1_2_07998448 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799E366 |
1_2_0799E366 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B76CE0 |
1_2_08B76CE0 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B7CCE8 |
1_2_08B7CCE8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B79058 |
1_2_08B79058 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B70040 |
1_2_08B70040 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B735A8 |
1_2_08B735A8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B78518 |
1_2_08B78518 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B70EE0 |
1_2_08B70EE0 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B7E670 |
1_2_08B7E670 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B7E368 |
1_2_08B7E368 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B728A8 |
1_2_08B728A8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B72899 |
1_2_08B72899 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B77CF8 |
1_2_08B77CF8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B77CE8 |
1_2_08B77CE8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B76CD2 |
1_2_08B76CD2 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B740DD |
1_2_08B740DD |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B70006 |
1_2_08B70006 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B73400 |
1_2_08B73400 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B71460 |
1_2_08B71460 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B79048 |
1_2_08B79048 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B71DB9 |
1_2_08B71DB9 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B735A2 |
1_2_08B735A2 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B73188 |
1_2_08B73188 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B71DC8 |
1_2_08B71DC8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B7ED08 |
1_2_08B7ED08 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B78508 |
1_2_08B78508 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B73178 |
1_2_08B73178 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B74158 |
1_2_08B74158 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B7AD48 |
1_2_08B7AD48 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B7C6A8 |
1_2_08B7C6A8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B70E01 |
1_2_08B70E01 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B72BA8 |
1_2_08B72BA8 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B72B98 |
1_2_08B72B98 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B733F2 |
1_2_08B733F2 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B72F50 |
1_2_08B72F50 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B72F41 |
1_2_08B72F41 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_08B7BF40 |
1_2_08B7BF40 |
Source: C:\Windows\System32\fontdrvhost.exe |
Code function: 22_2_000001BE066E0C70 |
22_2_000001BE066E0C70 |
Source: unknown |
Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" |
|
Source: C:\Users\user\Desktop\file.exe |
Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
|
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" |
|
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" |
|
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" |
|
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" |
|
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe |
Process created: C:\Windows\SysWOW64\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe" |
|
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe |
Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 420 |
|
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe" |
|
Source: C:\Windows\System32\fontdrvhost.exe |
Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8124 -s 136 |
|
Source: C:\Users\user\Desktop\file.exe |
Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe |
Process created: C:\Windows\SysWOW64\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe" |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe" |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: cabinet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: feclient.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: advpack.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: |
Binary string: wextract.pdb source: file.exe |
Source: |
Binary string: wextract.pdbGCTL source: file.exe |
Source: |
Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: computerlead.exe, 00000001.00000002.2938052510.00000000056B0000.00000004.08000000.00040000.00000000.sdmp |
Source: |
Binary string: wkernel32.pdb source: fontdrvhost.exe, 00000012.00000003.2945316096.0000000004C00000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2945134717.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wkernelbase.pdb source: fontdrvhost.exe, 00000012.00000003.2945665948.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2946060481.0000000004D00000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: ntdll.pdb source: fontdrvhost.exe, 00000012.00000003.2943041755.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2943531107.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdbUGP source: fontdrvhost.exe, 00000012.00000003.2944071441.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2944366502.0000000004C80000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: ntdll.pdbUGP source: fontdrvhost.exe, 00000012.00000003.2943041755.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2943531107.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: fontdrvhost.exe, 00000012.00000003.2944071441.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2944366502.0000000004C80000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wkernel32.pdbUGP source: fontdrvhost.exe, 00000012.00000003.2945316096.0000000004C00000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2945134717.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp |
Source: |
Binary string: wkernelbase.pdbUGP source: fontdrvhost.exe, 00000012.00000003.2945665948.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 00000012.00000003.2946060481.0000000004D00000.00000004.00000001.00020000.00000000.sdmp |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_018071F8 pushfd ; retf |
1_2_01807315 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_0799D682 push 9B0799D0h; iretd |
1_2_0799D695 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_07998448 push FFFFFFC3h; ret |
1_2_079986B5 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Code function: 1_2_079972AD pushad ; ret |
1_2_079972B3 |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B6012 push 00000038h; iretd |
18_3_003B601D |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B5606 pushad ; retf |
18_3_003B5619 |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B225D push eax; ret |
18_3_003B225F |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B58BC pushad ; ret |
18_3_003B58C1 |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B588E push eax; iretd |
18_3_003B589D |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B28ED push ebx; ret |
18_3_003B28E4 |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B18C0 push ebp; retf |
18_3_003B18C1 |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B4920 push 0000002Eh; iretd |
18_3_003B4922 |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B5F0C push es; iretd |
18_3_003B5F0D |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B1179 push FFFFFF82h; iretd |
18_3_003B117B |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B278B push ebx; ret |
18_3_003B28E4 |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B0FEA push eax; ret |
18_3_003B0FF5 |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Code function: 18_3_003B5FEE push FFFFFFD2h; retf |
18_3_003B6011 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe |
Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\fontdrvhost.exe |
Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33204139332677172s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -38000s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -37874s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -37765s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -37656s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -37547s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -37438s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -37313s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -37203s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -37094s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -36969s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -36860s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -36735s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -36610s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -36485s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -36360s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -36235s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -36110s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -35985s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -35860s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -35735s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -35610s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -35485s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -35360s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -35181s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -35016s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34891s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34781s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34672s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34553s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34438s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34322s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34216s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34109s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -34000s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33891s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33781s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33672s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33563s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33438s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33313s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33188s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -33078s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -32968s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -32859s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -32745s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -32641s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -32516s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -32406s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -32297s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe TID: 7664 |
Thread sleep time: -32188s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 38000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 37874 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 37765 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 37656 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 37547 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 37438 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 37313 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 37203 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 37094 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 36969 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 36860 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 36735 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 36610 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 36485 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 36360 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 36235 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 36110 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 35985 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 35860 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 35735 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 35610 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 35485 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 35360 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 35181 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 35016 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34891 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34781 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34672 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34553 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34438 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34322 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34216 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34109 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 34000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 33891 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 33781 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 33672 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 33563 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 33438 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 33313 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 33188 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 33078 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 32968 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 32859 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 32745 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 32641 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 32516 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 32406 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 32297 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Thread delayed: delay time: 32188 |
Jump to behavior |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware Virtual USB Mouse |
Source: Amcache.hve.24.dr |
Binary or memory string: vmci.syshbin |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware, Inc. |
Source: computerlead.exe, 00000001.00000002.2938052510.00000000056B0000.00000004.08000000.00040000.00000000.sdmp |
Binary or memory string: sandboxierpcssGSOFTWARE\VMware, Inc.\VMware VGAuth |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware20,1hbin@ |
Source: Amcache.hve.24.dr |
Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.24.dr |
Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.24.dr |
Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys |
Source: fontdrvhost.exe, 00000012.00000002.3046069328.000000000093A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWi.csvl |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20 |
Source: fontdrvhost.exe, 00000012.00000002.3046069328.000000000093A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW |
Source: Amcache.hve.24.dr |
Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.24.dr |
Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev |
Source: Amcache.hve.24.dr |
Binary or memory string: c:/windows/system32/drivers/vmci.sys |
Source: Amcache.hve.24.dr |
Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.24.dr |
Binary or memory string: vmci.sys |
Source: Amcache.hve.24.dr |
Binary or memory string: vmci.syshbin` |
Source: Amcache.hve.24.dr |
Binary or memory string: \driver\vmci,\driver\pci |
Source: Amcache.hve.24.dr |
Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: fontdrvhost.exe, 00000012.00000003.2946060481.0000000004D00000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: DisableGuestVmNetworkConnectivity |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware20,1 |
Source: Amcache.hve.24.dr |
Binary or memory string: Microsoft Hyper-V Generation Counter |
Source: Amcache.hve.24.dr |
Binary or memory string: NECVMWar VMware SATA CD00 |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware Virtual disk SCSI Disk Device |
Source: computerlead.exe, 00000001.00000002.2938052510.00000000056B0000.00000004.08000000.00040000.00000000.sdmp |
Binary or memory string: VBoxTrayS |
Source: Amcache.hve.24.dr |
Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom |
Source: Amcache.hve.24.dr |
Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk |
Source: Amcache.hve.24.dr |
Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware PCI VMCI Bus Device |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware VMCI Bus Device |
Source: Amcache.hve.24.dr |
Binary or memory string: VMware Virtual RAM |
Source: fontdrvhost.exe, 00000012.00000003.2946060481.0000000004D00000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: EnableGuestVmNetworkConnectivity |
Source: Amcache.hve.24.dr |
Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1 |
Source: Amcache.hve.24.dr |
Binary or memory string: vmci.inf_amd64_68ed49469341f563 |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 350000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 351000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 399000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 3C8000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 3CC000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 3CE000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 4DF008 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 530000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 531000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 579000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 5A8000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 5AC000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 5AE000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 3B1008 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 500000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 501000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 549000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 578000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 57C000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 57E000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 3E2008 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 449000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47C000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\computerlead.exe |
Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 10A6008 |
Jump to behavior |