Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 184.31.62.93 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 199.232.214.172 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 199.232.214.172 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 20.12.23.50 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 199.232.214.172 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 199.232.214.172 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: global traffic |
HTTP traffic detected: GET /wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx HTTP/1.1Host: makeoversalon.net.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: makeoversalon.net.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com |
Source: global traffic |
HTTP traffic detected: GET /cookieimg.php HTTP/1.1Host: admin.bitninja.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://makeoversalon.net.in/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /cookieimg.php HTTP/1.1Host: admin.bitninja.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-1975075-20&cid=1276044083.1713594250&jid=1814692829&gjid=287345157&_gid=1937593962.1713594250&_u=YEBAAUAAAAAAACAAI~&z=981243278 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-1975075-20&cid=1276044083.1713594250&jid=1814692829&_u=YEBAAUAAAAAAACAAI~&z=711350274 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://makeoversalon.net.in/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-1975075-20&cid=1276044083.1713594250&jid=1814692829&_u=YEBAAUAAAAAAACAAI~&z=711350274 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://recaptcha.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=htoAzWVomMrkLpL&MD=Ye3Vu7rv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com |
Source: global traffic |
HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=htoAzWVomMrkLpL&MD=Ye3Vu7rv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com |
Source: wscript.exe, 00000000.00000003.1756157743.0000022AC66E0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1758731467.000000E2A20F9000.00000004.00000010.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756206708.0000022AC5CE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1757741056.0000022AC5E50000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://admin.bitninja.io/cookieimg.php |
Source: chromecache_58.7.dr |
String found in binary or memory: https://adservice.google.com/pagead/regclk |
Source: chromecache_58.7.dr |
String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk |
Source: chromecache_61.7.dr |
String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId |
Source: wscript.exe, 00000000.00000003.1742392823.0000022AC5D1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1758237969.0000022AC5D17000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1742879491.0000022AC5D10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1742572781.0000022AC5D17000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1742392823.0000022AC5D10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1757757779.0000022AC5E45000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1743103250.0000022AC5D10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756206708.0000022AC5D10000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://bitninja.io |
Source: chromecache_58.7.dr, chromecache_66.7.dr |
String found in binary or memory: https://cct.google/taggy/agent.js |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://cloud.google.com/contact |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que |
Source: wscript.exe, 00000000.00000002.1759178536.0000022AC3C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1757521098.0000022AC3C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1760015537.0000022AC6680000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1757235721.0000022AC3C8D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/ |
Source: wscript.exe, 00000000.00000002.1759178536.0000022AC3C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1757521098.0000022AC3C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1757235721.0000022AC3C8D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/RL- |
Source: wscript.exe, 00000000.00000002.1759807591.0000022AC5CE4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756381491.0000022AC5CDF000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/uage: |
Source: wscript.exe, 00000000.00000002.1759472586.0000022AC3E39000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1743103250.0000022AC5D10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1758636562.0000022AC5A14000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-im |
Source: wscript.exe, 00000000.00000003.1694351636.0000022AC5A4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1759344841.0000022AC3CDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756527502.0000022AC5CCF000.00000004.00000020.00020000.00000000.sdmp, Essay on Resolution of Korean Forced Labor Claims.vbs |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/r.php |
Source: wscript.exe, 00000000.00000003.1756695458.0000022AC3CDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1759344841.0000022AC3CDD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/r.phpT |
Source: wscript.exe, 00000000.00000002.1759784200.0000022AC5CD1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756399890.0000022AC5CC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1742695487.0000022AC5CCF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756527502.0000022AC5CCF000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/r.phpj6 |
Source: wscript.exe, 00000000.00000003.1756695458.0000022AC3CDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1759344841.0000022AC3CDD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/r.phpw |
Source: wscript.exe, 00000000.00000003.1694351636.0000022AC5A4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756527502.0000022AC5CCF000.00000004.00000020.00020000.00000000.sdmp, Essay on Resolution of Korean Forced Labor Claims.vbs |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.php |
Source: wscript.exe, 00000000.00000002.1760015537.0000022AC6680000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.php1y |
Source: wscript.exe, 00000000.00000003.1693830385.0000022AC5A3F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.php33 |
Source: wscript.exe, 00000000.00000003.1757757779.0000022AC5E45000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.php4aZF$ |
Source: wscript.exe, 00000000.00000002.1759784200.0000022AC5CD1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756399890.0000022AC5CC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756527502.0000022AC5CCF000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.phpY8 |
Source: wscript.exe, 00000000.00000002.1759784200.0000022AC5CD1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756399890.0000022AC5CC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756527502.0000022AC5CCF000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.phpe? |
Source: wscript.exe, 00000000.00000002.1759784200.0000022AC5CD1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756399890.0000022AC5CC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1756527502.0000022AC5CCF000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.phpq8 |
Source: explorer.exe, 00000004.00000002.2301016804.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, Essay on Resolution of Korean Forced Labor Claims.vbs |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx |
Source: explorer.exe, 00000004.00000002.2301016804.0000000000B60000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx(eK3 |
Source: explorer.exe, 00000004.00000003.2300805746.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2301140793.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxD |
Source: explorer.exe, 00000004.00000003.2300805746.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2301140793.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxH |
Source: explorer.exe, 00000004.00000002.2301016804.0000000000B60000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxPe |
Source: explorer.exe, 00000004.00000002.2301180539.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2300646799.0000000000B85000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxV |
Source: explorer.exe, 00000004.00000002.2301016804.0000000000B60000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxd |
Source: explorer.exe, 00000004.00000002.2301016804.0000000000B60000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxll |
Source: explorer.exe, 00000004.00000002.2301180539.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2300646799.0000000000B85000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxp |
Source: chromecache_58.7.dr, chromecache_66.7.dr |
String found in binary or memory: https://pagead2.googlesyndication.com |
Source: chromecache_58.7.dr, chromecache_66.7.dr |
String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe |
Source: chromecache_62.7.dr |
String found in binary or memory: https://play.google.com/log?format=json&hasfast=true |
Source: chromecache_62.7.dr |
String found in binary or memory: https://recaptcha.net |
Source: wscript.exe, 00000000.00000003.1757741056.0000022AC5E50000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://recaptcha.net/recaptcha/api.js |
Source: chromecache_67.7.dr |
String found in binary or memory: https://recaptcha.net/recaptcha/api2/ |
Source: chromecache_58.7.dr |
String found in binary or memory: https://stats.g.doubleclick.net/g/collect |
Source: chromecache_58.7.dr |
String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2& |
Source: chromecache_61.7.dr |
String found in binary or memory: https://stats.g.doubleclick.net/j/collect |
Source: chromecache_62.7.dr |
String found in binary or memory: https://support.google.com/recaptcha |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://support.google.com/recaptcha#6262736 |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://support.google.com/recaptcha/#6175971 |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828 |
Source: chromecache_61.7.dr |
String found in binary or memory: https://tagassistant.google.com/ |
Source: chromecache_58.7.dr, chromecache_66.7.dr |
String found in binary or memory: https://td.doubleclick.net |
Source: chromecache_66.7.dr |
String found in binary or memory: https://www.google-analytics.com/analytics.js |
Source: chromecache_61.7.dr |
String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id= |
Source: chromecache_61.7.dr |
String found in binary or memory: https://www.google-analytics.com/gtm/js?id= |
Source: chromecache_61.7.dr |
String found in binary or memory: https://www.google.%/ads/ga-audiences |
Source: chromecache_58.7.dr, chromecache_66.7.dr |
String found in binary or memory: https://www.google.com |
Source: chromecache_61.7.dr |
String found in binary or memory: https://www.google.com/ads/ga-audiences |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://www.google.com/recaptcha/api2/ |
Source: chromecache_58.7.dr, chromecache_66.7.dr |
String found in binary or memory: https://www.googleadservices.com |
Source: chromecache_58.7.dr, chromecache_66.7.dr |
String found in binary or memory: https://www.googletagmanager.com |
Source: chromecache_61.7.dr |
String found in binary or memory: https://www.googletagmanager.com/gtag/js?id= |
Source: wscript.exe, 00000000.00000003.1757757779.0000022AC5E45000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-1975075-20 |
Source: chromecache_57.7.dr, chromecache_62.7.dr |
String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__. |
Source: chromecache_56.7.dr, chromecache_67.7.dr |
String found in binary or memory: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js |
Source: chromecache_58.7.dr |
String found in binary or memory: https://www.merchant-center-analytics.goog |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49744 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49743 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49742 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49786 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49740 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49784 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49782 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49743 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49762 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49746 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49769 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49776 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49738 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49759 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49735 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49753 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49734 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49772 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49777 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49776 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49772 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49742 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49767 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49784 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49749 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49777 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49735 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49769 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49768 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49767 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49762 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49760 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49760 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49745 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49759 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49755 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49738 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49755 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49782 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49754 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49734 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49753 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49786 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49740 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49744 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49768 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49749 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49754 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49746 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49745 |
Source: unknown |
Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Essay on Resolution of Korean Forced Labor Claims.vbs" |
|
Source: C:\Windows\System32\wscript.exe |
Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c explorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx" |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\explorer.exe explorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx" |
|
Source: unknown |
Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx |
|
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2036,i,652845326045474574,16795533122018123490,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
|
Source: C:\Windows\System32\wscript.exe |
Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c explorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx" |
Jump to behavior |
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\explorer.exe explorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx" |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2036,i,652845326045474574,16795533122018123490,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: sxs.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: vbscript.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: scrobj.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: scrrun.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: msxml3.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: mlang.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: aepic.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: twinapi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: wtsapi32.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: ninput.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: explorerframe.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: actxprxy.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: aepic.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: twinapi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: wtsapi32.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: ninput.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: explorerframe.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: actxprxy.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.shell.servicehostbuilder.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: ieframe.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: netapi32.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: wkscli.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: mlang.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: policymanager.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: msvcp110_win.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: pcacli.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: sfc_os.dll |
Jump to behavior |