Program did not start
General Info
- File name
-
pf.zip
- Verdict
- Malicious activity
- Analysis date
- 11/22/2020, 13:03:08
- OS:
- Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
- Indicators:
- MIME:
- application/zip
- File info:
- Zip archive data, at least v2.0 to extract
- MD5
-
90b901191fb837ecd03b591d2ceefd9a
- SHA1
-
bf200150dd3f4f61898b44f53f6756c804821094
- SHA256
-
f4c1d831719deff3f583396038b9181b316e509ac410132bfa4ee2334c3121f6
- SSDEEP
-
49152:TmPNJDnvx4+Zf95vAH3W0l79GFmZS0bn3VLIPLS0Le:6Fr4+Zfh0t9RZS0bn3BSB6
Software environment set and analysis options
Launch configuration
- Task duration
- 900 seconds
- Additional time used
- 240 seconds
- Fakenet option
- off
- Heavy Evaision option
- off
- MITM proxy
- on
- Route via Tor
- off
- Network geolocation
- off
- Privacy
- Public submission
- Autoconfirmation of UAC
- on
Software preset
- Internet Explorer 11.0.9600.18860
KB4052978
- Adobe Acrobat Reader DC MUI (15.007.20033)
- Adobe Flash Player 27 ActiveX (27.0.0.187)
- Adobe Flash Player 27 NPAPI (27.0.0.187)
- Adobe Flash Player 27 PPAPI (27.0.0.187)
- CCleaner (5.35)
- Google Chrome (75.0.3770.100)
- Google Update Helper (1.3.33.23)
- Java 8 Update 92 (64-bit) (8.0.920.14)
- Java Auto Updater (2.8.92.14)
- Microsoft .NET Framework 4.7.2 (4.7.03062)
- Microsoft Office Access MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Groove MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office IME (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office IME (Korean) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Language Pack 2010 - French/Français (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - German/Deutsch (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Italian/Italiano (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Japanese/日本語 (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Korean/한국어 (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Portuguese/Português (Brasil) (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Russian/русский (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Spanish/Español (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Turkish/Türkçe (14.0.4763.1013)
- Microsoft Office O MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Office 32-bit Components 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Outlook MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office PowerPoint MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Professional 2010 (14.0.4763.1000)
- Microsoft Office Proof (Arabic) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Basque) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Catalan) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Dutch) 2010 (14.0.4763.1000)
- Microsoft Office Proof (English) 2010 (14.0.4763.1000)
- Microsoft Office Proof (French) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Galician) 2010 (14.0.4763.1000)
- Microsoft Office Proof (German) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Proof (Ukrainian) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (English) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (French) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (German) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Publisher MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office SharePoint Designer MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Shared 32-bit MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Shared 32-bit MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Shared MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Single Image 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (English) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office X MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Visual C++ 2005 Redistributable (x64) (8.0.61000)
- Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (9.0.30729.6161)
- Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (10.0.40219)
- Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (11.0.61030.0)
- Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (11.0.61030)
- Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (11.0.61030)
- Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
- Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
- Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
- Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.21.27702 (14.21.27702.2)
- Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
- Microsoft Visual C++ 2019 X64 Additional Runtime - 14.21.27702 (14.21.27702)
- Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.21.27702 (14.21.27702)
- Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
- Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
- Mozilla Firefox 67.0.4 (x64 en-US) (67.0.4)
- Mozilla Maintenance Service (67.0.4)
- Notepad++ (64-bit x64) (7.5.1)
- Opera 12.15 (12.15.1748)
- Skype™ 7.39 (7.39.102)
- Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
- VLC media player (2.2.6)
- WinRAR 5.60 (64-bit) (5.60.0)
- srvpost (2.12.72)
Hotfixes
- Client LanguagePack Package
- Client Refresh LanguagePack Package
- CodecPack Basic Package
- Foundation Package
- IE Hyphenation Parent Package English
- IE Spelling Parent Package English
- IE Troubleshooters Package
- InternetExplorer Optional Package
- InternetExplorer Package TopLevel
- KB2479943
- KB2491683
- KB2506014
- KB2506212
- KB2506928
- KB2509553
- KB2532531
- KB2533552
- KB2534111
- KB2545698
- KB2547666
- KB2552343
- KB2560656
- KB2563227
- KB2564958
- KB2579686
- KB2585542
- KB2585542 SP1
- KB2598845
- KB2603229
- KB2604115
- KB2620704
- KB2621440
- KB2631813
- KB2640148
- KB2653956
- KB2654428
- KB2656356
- KB2656356 SP1
- KB2660075
- KB2667402
- KB2685811
- KB2685813
- KB2685939
- KB2690533
- KB2698365
- KB2705219
- KB2706045
- KB2719857
- KB2726535
- KB2727528
- KB2729094
- KB2729452
- KB2732059
- KB2732487
- KB2736422
- KB2742599
- KB2750841
- KB2758857
- KB2761217
- KB2763523
- KB2770660
- KB2773072
- KB2786081
- KB2789645
- KB2789645 SP1
- KB2791765
- KB2799926
- KB2800095
- KB2807986
- KB2808679
- KB2813430
- KB2834140
- KB2836942
- KB2836943
- KB2840631
- KB2843630
- KB2847927
- KB2852386
- KB2853952
- KB2861698
- KB2862152
- KB2862330
- KB2862335
- KB2864202
- KB2868038
- KB2871997
- KB2884256
- KB2888049
- KB2891804
- KB2892074
- KB2893294
- KB2893519
- KB2894844
- KB2900986
- KB2908783
- KB2911501
- KB2912390
- KB2918077
- KB2919469
- KB2931356
- KB2937610
- KB2943357
- KB2952664
- KB2966583
- KB2968294
- KB2970228
- KB2972100
- KB2972211
- KB2973112
- KB2973201
- KB2973351
- KB2977292
- KB2978120
- KB2978742
- KB2984972
- KB2985461
- KB2991963
- KB2992611
- KB3003743
- KB3004361
- KB3004375
- KB3006121
- KB3006137
- KB3010788
- KB3011780
- KB3013531
- KB3019978
- KB3020370
- KB3021674
- KB3021917
- KB3022777
- KB3023215
- KB3030377
- KB3031432
- KB3035126
- KB3035132
- KB3037574
- KB3042058
- KB3045685
- KB3046017
- KB3046269
- KB3054476
- KB3055642
- KB3059317
- KB3060716
- KB3067903
- KB3068708
- KB3071756
- KB3072305
- KB3074543
- KB3075220
- KB3076895
- KB3078601
- KB3078667
- KB3080149
- KB3084135
- KB3086255
- KB3092601
- KB3092627
- KB3093513
- KB3097989
- KB3101722
- KB3107998
- KB3108371
- KB3108381
- KB3108664
- KB3109103
- KB3109560
- KB3110329
- KB3115858
- KB3115858 SP1
- KB3122648
- KB3124275
- KB3126587
- KB3127220
- KB3133977
- KB3137061
- KB3138378
- KB3138612
- KB3138910
- KB3139398
- KB3139914
- KB3140245
- KB3147071
- KB3150220
- KB3155178
- KB3156016
- KB3156019
- KB3159398
- KB3161102
- KB3161949
- KB3161958
- KB3170735
- KB3170735 SP1
- KB3172605
- KB3177467
- KB3179573
- KB3184143
- KB4019990
- KB4040980
- KB976902
- KB982018
- LocalPack AU Package
- LocalPack CA Package
- LocalPack GB Package
- LocalPack US Package
- LocalPack ZA Package
- Package 1 for KB2656356
- Package 1 for KB2789645
- Package 1 for KB3115858
- Package 1 for KB3170735
- Package 2 for KB2585542
- Package 2 for KB2656356
- Package 2 for KB2789645
- Package 2 for KB3115858
- Package 2 for KB3170735
- Package 3 for KB2585542
- Package 3 for KB2656356
- Package 4 for KB2656356
- Package 4 for KB2789645
- Package 5 for KB2656356
- Package 7 for KB2656356
- PlatformUpdate Win7 SRV08R2 Package TopLevel
- ProfessionalEdition
- RollupFix
- UltimateEdition
- WUClient SelfUpdate ActiveX
- WUClient SelfUpdate Aux TopLevel
- WUClient SelfUpdate Core TopLevel
Behavior activities
| MALICIOUS | SUSPICIOUS | INFO |
|---|---|---|
Loads the Task Scheduler COM API
|
Low-level read access rights to disk partition
|
Loads dropped or rewritten executable
|
Static information
TRiD
.zip
|
ZIP compressed archive (100%)
EXIF
ZIP
ZipRequiredVersion:
20
ZipBitFlag:
null
ZipCompression:
Deflated
ZipModifyDate:
2020:11:22 21:38:19
ZipCRC:
0xdc9b30a2
ZipCompressedSize:
1885603
ZipUncompressedSize:
1920389
ZipFileName:
M0021.cab
Video and screenshots
Processes
Total processes
165
Monitored processes
53
Malicious processes
8
Suspicious processes
0
Behavior graph
–
+
Specs description
Integrity level
elevation
Task сontains an error
or was rebooted
Process has crashed
Task contains several
apps running
Executable file was
dropped
Debug information is
available
Process was injected
Network attacks were
detected
Application downloaded
the executable file
Actions similar to
stealing personal data
Behavior similar to
exploiting the vulnerability
Inspected object has
sucpicious PE structure
File is detected by
antivirus software
CPU overrun
RAM overrun
Process starts the
services
Process was added to
the startup
Behavior similar to
spam
Low-level access to
the HDD
Probably Tor was used
System was rebooted
Connects to the
network
Known threat
Process information
Click at the process to see the details.
- PID
- 2696
- CMD
- "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\pf.zip"
- Path
- C:\Program Files\WinRAR\WinRAR.exe
- Indicators
- Parent process
- ––
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Alexander Roshal
- Description
- WinRAR archiver
- Version
- 5.60.0
Modules
| Image |
|---|
| c:\program files\winrar\winrar.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\gdiplus.dll |
| c:\windows\system32\msimg32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\riched20.dll |
| c:\windows\system32\ime\imejp10\imjptip.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\imjp10k.dll |
| c:\windows\system32\ime\shared\imetip.dll |
| c:\windows\system32\ime\shared\imecfm.dll |
| c:\windows\system32\ime\imejp10\imjpapi.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\ime\shared\imjkapi.dll |
| c:\program files\common files\microsoft shared\ink\tiptsf.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\ehstorshell.dll |
| c:\windows\system32\cscui.dll |
| c:\windows\system32\cscdll.dll |
| c:\windows\system32\cscapi.dll |
| c:\windows\system32\ntshrui.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\imageres.dll |
| c:\windows\system32\mpr.dll |
| c:\windows\system32\drprov.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\ntlanman.dll |
| c:\windows\system32\davclnt.dll |
| c:\windows\system32\davhlpr.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\wpdshext.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\portabledeviceapi.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\ehstorapi.dll |
| c:\windows\system32\shdocvw.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\samlib.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\msimsg.dll |
| c:\windows\system32\msiexec.exe |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\explorerframe.dll |
| c:\windows\system32\duser.dll |
| c:\windows\system32\dui70.dll |
- PID
- 2176
- CMD
- "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\6.msi"
- Path
- C:\Windows\System32\msiexec.exe
- Indicators
- No indicators
- Parent process
- ––
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Windows® installer
- Version
- 5.0.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\msiexec.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\msi.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\apppatch\apppatch64\aclayers.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\mpr.dll |
| c:\windows\apppatch\apppatch64\acgenral.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\sfc.dll |
| c:\windows\system32\sfc_os.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\msimsg.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ime\imejp10\imjptip.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\imjp10k.dll |
| c:\windows\system32\ime\shared\imetip.dll |
| c:\windows\system32\ime\shared\imecfm.dll |
| c:\windows\system32\ime\imejp10\imjpapi.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\ime\shared\imjkapi.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\sxs.dll |
| c:\windows\system32\mscoree.dll |
| c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll |
| c:\windows\microsoft.net\framework64\v4.0.30319\clr.dll |
| c:\windows\microsoft.net\framework64\v4.0.30319\fusion.dll |
- PID
- 2964
- CMD
- C:\Windows\system32\msiexec.exe /V
- Path
- C:\Windows\system32\msiexec.exe
- Indicators
- Parent process
- ––
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Windows® installer
- Version
- 5.0.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\msiexec.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\msi.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\apppatch\apppatch64\aclayers.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\mpr.dll |
| c:\windows\apppatch\apppatch64\acgenral.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\sfc.dll |
| c:\windows\system32\sfc_os.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\msimsg.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\sxs.dll |
| c:\windows\system32\mscoree.dll |
| c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll |
| c:\windows\microsoft.net\framework64\v4.0.30319\clr.dll |
| c:\windows\microsoft.net\framework64\v4.0.30319\fusion.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\bcryptprimitives.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\devrtl.dll |
| c:\windows\system32\cabinet.dll |
- PID
- 1352
- CMD
- C:\Windows\syswow64\MsiExec.exe -Embedding DF0FF1F891B6A720E9C78151C2592EF3
- Path
- C:\Windows\syswow64\MsiExec.exe
- Indicators
- Parent process
- msiexec.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Windows® installer
- Version
- 5.0.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\msiexec.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\msi.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\apphelp.dll |
| c:\windows\apppatch\aclayers.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\winspool.drv |
| c:\windows\syswow64\mpr.dll |
| c:\windows\apppatch\acgenral.dll |
| c:\windows\syswow64\uxtheme.dll |
| c:\windows\syswow64\winmm.dll |
| c:\windows\syswow64\samcli.dll |
| c:\windows\syswow64\msacm32.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\sfc.dll |
| c:\windows\syswow64\sfc_os.dll |
| c:\windows\syswow64\dwmapi.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\urlmon.dll |
| c:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll |
| c:\windows\syswow64\normaliz.dll |
| c:\windows\syswow64\iertutil.dll |
| c:\windows\syswow64\wininet.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\installer\msi6934.tmp |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\comdlg32.dll |
| c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\installer\msi6cdf.tmp |
| c:\windows\installer\msi6d0f.tmp |
| c:\windows\installer\msi6d2f.tmp |
- PID
- 1736
- CMD
- C:\Windows\syswow64\MsiExec.exe -Embedding 38C4768EC0B229C089DC8CDB53D4BAF7 E Global\MSI0000
- Path
- C:\Windows\syswow64\MsiExec.exe
- Indicators
- No indicators
- Parent process
- msiexec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Windows® installer
- Version
- 5.0.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\msiexec.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\msi.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\apphelp.dll |
| c:\windows\apppatch\aclayers.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\winspool.drv |
| c:\windows\syswow64\mpr.dll |
| c:\windows\apppatch\acgenral.dll |
| c:\windows\syswow64\uxtheme.dll |
| c:\windows\syswow64\winmm.dll |
| c:\windows\syswow64\samcli.dll |
| c:\windows\syswow64\msacm32.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\sfc.dll |
| c:\windows\syswow64\sfc_os.dll |
| c:\windows\syswow64\dwmapi.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\urlmon.dll |
| c:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll |
| c:\windows\syswow64\normaliz.dll |
| c:\windows\syswow64\iertutil.dll |
| c:\windows\syswow64\wininet.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\vbscript.dll |
| c:\windows\syswow64\wshom.ocx |
| c:\windows\syswow64\scrrun.dll |
| c:\windows\syswow64\sxs.dll |
| c:\windows\syswow64\propsys.dll |
| c:\windows\syswow64\ieframe.dll |
| c:\windows\syswow64\api-ms-win-downlevel-shell32-l1-1-0.dll |
| c:\windows\syswow64\ntmarta.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\secur32.dll |
| c:\windows\syswow64\netsh.exe |
| c:\windows\syswow64\takeown.exe |
| c:\windows\syswow64\cacls.exe |
| c:\windows\syswow64\windowspowershell\v1.0\powershell.exe |
- PID
- 2932
- CMD
- "C:\Windows\SysWOW64\netsh.exe" interface ipv6 install
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 1
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 1460
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2888
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter1
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2780
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2596
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2800
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2212
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 3048
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2760
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2796
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=2222 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2844
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=3333 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2896
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=4444 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2976
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=5555 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 684
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=6666 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2664
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=7777 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 3004
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=8888 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2936
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9000 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2876
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9999 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2976
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14443 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\wow64win.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2660
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14444 protocol=TCP
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 116
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2876
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\wow64win.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2056
- CMD
- "C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y
- Path
- C:\Windows\SysWOW64\netsh.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Network Command Shell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\netsh.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\syswow64\mprapi.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasman.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\mfc42u.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbcint.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpqec.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\wevtapi.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\ws2help.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\nshhttp.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\fwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\bcrypt.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\ifmon.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\nci.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\netiohlp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\whhelper.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\netshell.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\dot3cfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\onex.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\napmontr.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\logoncli.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\adsldpc.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\p2pnetsh.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\p2pcollab.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\wlanapi.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlanhlp.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\qagent.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\bcryptprimitives.dll |
- PID
- 2492
- CMD
- "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\jscript.dll
- Path
- C:\Windows\SysWOW64\takeown.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Takes ownership of a file
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\takeown.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\secur32.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\syswow64\ntmarta.dll |
| c:\windows\syswow64\wldap32.dll |
- PID
- 2852
- CMD
- "C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\jscript.dll /E /P everyone:N
- Path
- C:\Windows\SysWOW64\cacls.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Control ACLs Program
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\cacls.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
- PID
- 2704
- CMD
- "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\jscript.dll
- Path
- C:\Windows\SysWOW64\takeown.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Takes ownership of a file
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\takeown.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\secur32.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
- PID
- 996
- CMD
- "C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\jscript.dll /E /P everyone:N
- Path
- C:\Windows\SysWOW64\cacls.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Control ACLs Program
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\cacls.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
- PID
- 2180
- CMD
- "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\cscript.exe
- Path
- C:\Windows\SysWOW64\takeown.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Takes ownership of a file
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\syswow64\takeown.exe |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\secur32.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\syswow64\ntmarta.dll |
| c:\windows\syswow64\wldap32.dll |
- PID
- 2412
- CMD
- "C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\cscript.exe /E /P everyone:N
- Path
- C:\Windows\SysWOW64\cacls.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Control ACLs Program
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\cacls.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
- PID
- 684
- CMD
- "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\cscript.exe
- Path
- C:\Windows\SysWOW64\takeown.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Takes ownership of a file
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\gpapi.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\peerdistsh.dll |
| c:\windows\syswow64\wlanutil.dll |
| c:\windows\syswow64\wlancfg.dll |
| c:\windows\syswow64\p2p.dll |
| c:\windows\syswow64\polstore.dll |
| c:\windows\syswow64\activeds.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\nshipsec.dll |
| c:\windows\syswow64\certcli.dll |
| c:\windows\syswow64\eappprxy.dll |
| c:\windows\syswow64\eappcfg.dll |
| c:\windows\syswow64\dot3api.dll |
| c:\windows\syswow64\rpcnsh.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\hnetmon.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\devrtl.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\winipsec.dll |
| c:\windows\syswow64\authfwcfg.dll |
| c:\windows\syswow64\firewallapi.dll |
| c:\windows\syswow64\httpapi.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\wshelper.dll |
| c:\windows\syswow64\qutil.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpcmonitor.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\nshwfp.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\odbc32.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\rasapi32.dll |
| c:\windows\syswow64\rasmontr.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\credui.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\wow64win.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\syswow64\netsh.exe |
| c:\windows\syswow64\takeown.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\mpr.dll |
| c:\windows\syswow64\secur32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\msctf.dll |
- PID
- 2952
- CMD
- "C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\cscript.exe /E /P everyone:N
- Path
- C:\Windows\SysWOW64\cacls.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Control ACLs Program
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\cacls.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
- PID
- 3000
- CMD
- "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 900; Restart-Computer -Force
- Path
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
- Indicators
- No indicators
- Parent process
- MsiExec.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 1073807364
- Version:
- Company
- Microsoft Corporation
- Description
- Windows PowerShell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\windowspowershell\v1.0\powershell.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\atl.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\mscoree.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\apphelp.dll |
| c:\windows\syswow64\shdocvw.dll |
| c:\windows\syswow64\propsys.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\ntmarta.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\linkinfo.dll |
| c:\windows\syswow64\ntshrui.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\cscapi.dll |
| c:\windows\syswow64\slc.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll |
| c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system\ad92dab7f418877d6a1e0358ce35658a\system.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\18bfcf1ce2ee2590fab9e652aa2fb0f0\microsoft.powershell.consolehost.ni.dll |
| c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\038e2b6a0fca5134cc94bdba268aa678\system.management.automation.ni.dll |
| c:\windows\syswow64\psapi.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\bd9ff1a4363781a57e8f7392f230a203\system.core.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\5899ed26db2d3dcca2a333abb64e3fd5\microsoft.powershell.commands.diagnostics.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\d6acc39f6c1ea42d8b3150db6184a969\system.configuration.install.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\dfeba9654bbb5cb83fd6b223bce5aa1a\microsoft.wsman.management.ni.dll |
| c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\fec007ea17ac8956cc5d6d4074dada6a\system.transactions.ni.dll |
| c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\50e48d6dfa9faf86ed7827f4ea0cc52a\microsoft.powershell.commands.utility.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\5f426e1d87e7c57b1650b2cd31ed90c5\microsoft.powershell.commands.management.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\2e8571d116616c901756ee2259985925\microsoft.powershell.security.ni.dll |
| c:\windows\microsoft.net\framework\v2.0.50727\culture.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\system.xml.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\00c2b464e52d4e82c04d61592a12a89d\system.management.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\237ed1739105c1bebe48d41905fdb3ee\system.directoryservices.ni.dll |
| c:\windows\syswow64\shfolder.dll |
| c:\windows\syswow64\secur32.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\511c39d1efa06d262a6b2f47e2726c73\system.data.ni.dll |
| c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll |
- PID
- 372
- CMD
- winlogon.exe
- Path
- C:\Windows\System32\winlogon.exe
- Indicators
- Parent process
- ––
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Version:
- Company
- Microsoft Corporation
- Description
- Windows Logon Application
- Version
- 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
| Image |
|---|
| c:\windows\system32\winlogon.exe |
| c:\windows\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\uxinit.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\netjoin.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\sspicli.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kbdus.dll |
| c:\windows\system32\kbdjpn.dll |
| c:\windows\system32\kbd101.dll |
| c:\windows\system32\kbd106.dll |
| c:\windows\system32\kbdnec.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\imjp14.ime |
| c:\windows\system32\slc.dll |
| c:\windows\system32\mpr.dll |
- PID
- 644
- CMD
- C:\Windows\system32\services.exe
- Path
- C:\Windows\System32\services.exe
- Indicators
- No indicators
- Parent process
- ––
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Version:
- Company
- Microsoft Corporation
- Description
- Services and Controller app
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\services.exe |
| c:\windows\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\scext.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\scesrv.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\credssp.dll |
| c:\windows\system32\authz.dll |
| c:\windows\system32\ubpm.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\winsta.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\aelupsvc.dll |
| c:\windows\system32\drivers\afd.sys |
| c:\windows\system32\alg.exe |
| c:\windows\system32\appidsvc.dll |
| c:\windows\system32\appinfo.dll |
| c:\windows\system32\appmgmts.dll |
| c:\windows\system32\rascfg.dll |
| c:\windows\system32\audiosrv.dll |
| c:\windows\system32\axinstsv.dll |
| c:\windows\system32\bdesvc.dll |
| c:\windows\system32\bfe.dll |
| c:\windows\system32\qmgr.dll |
| c:\windows\system32\browser.dll |
| c:\windows\system32\bthserv.dll |
| c:\windows\system32\certprop.dll |
| c:\windows\system32\clfs.sys |
| c:\windows\system32\comres.dll |
| c:\windows\system32\cryptsvc.dll |
| c:\windows\system32\cscsvc.dll |
| c:\windows\system32\oleres.dll |
| c:\windows\system32\defragsvc.dll |
| c:\windows\system32\drivers\dfsc.sys |
| c:\windows\system32\dhcpcore.dll |
| c:\windows\system32\utcresources.dll |
| c:\windows\system32\drivers\discache.sys |
| c:\windows\system32\dnsapi.dll |
| c:\windows\system32\dot3svc.dll |
| c:\windows\system32\eapsvc.dll |
| c:\windows\system32\efssvc.dll |
| c:\windows\ehome\ehrecvr.exe |
| c:\windows\ehome\ehsched.exe |
| c:\windows\system32\wevtsvc.dll |
| c:\windows\system32\fxsresm.dll |
| c:\windows\system32\fdphost.dll |
| c:\windows\system32\fdrespub.dll |
| c:\windows\system32\drivers\fileinfo.sys |
| c:\windows\system32\drivers\filetrace.sys |
| c:\windows\system32\drivers\fltmgr.sys |
| c:\windows\system32\fntcache.dll |
| c:\windows\system32\presentationhost.exe |
| c:\windows\system32\drivers\fsdepends.sys |
| c:\windows\system32\drivers\fvevol.sys |
| c:\windows\system32\gpapi.dll |
| c:\windows\system32\hidserv.dll |
| c:\windows\system32\kmsvc.dll |
| c:\windows\system32\listsvc.dll |
| c:\windows\system32\provsvc.dll |
| c:\windows\system32\drivers\http.sys |
| c:\windows\system32\drivers\hwpolicy.sys |
| c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\servicemodelinstallrc.dll |
| c:\windows\system32\ieetwcollectorres.dll |
| c:\windows\system32\ikeext.dll |
| c:\windows\system32\ipbusenum.dll |
| c:\windows\system32\iphlpsvc.dll |
| c:\windows\system32\drivers\irenum.sys |
| c:\windows\system32\keyiso.dll |
| c:\windows\system32\srvsvc.dll |
| c:\windows\system32\wkssvc.dll |
| c:\windows\system32\lltdres.dll |
| c:\windows\system32\lmhsvc.dll |
| c:\windows\system32\drivers\luafv.sys |
| c:\windows\ehome\ehres.dll |
| c:\windows\system32\mmcss.dll |
| c:\windows\system32\drivers\mountmgr.sys |
| c:\windows\system32\firewallapi.dll |
| c:\windows\system32\webclnt.dll |
| c:\windows\system32\drivers\mshidkmdf.sys |
| c:\windows\system32\iscsidsc.dll |
| c:\windows\system32\msimsg.dll |
| c:\windows\system32\drivers\mup.sys |
| c:\windows\system32\qagentrt.dll |
| c:\windows\system32\drivers\ndis.sys |
| c:\windows\system32\drivers\netbt.sys |
| c:\windows\system32\netlogon.dll |
| c:\windows\system32\netman.dll |
| c:\windows\microsoft.net\framework64\v4.0.30319\servicemodelinstallrc.dll |
| c:\windows\system32\netprofm.dll |
| c:\windows\system32\nlasvc.dll |
| c:\windows\system32\nsisvc.dll |
| c:\windows\system32\drivers\nsiproxy.sys |
| c:\windows\system32\pnrpsvc.dll |
| c:\windows\system32\p2psvc.dll |
| c:\windows\system32\drivers\partmgr.sys |
| c:\windows\system32\pcasvc.dll |
| c:\windows\system32\peerdistsvc.dll |
| c:\windows\system32\pla.dll |
| c:\windows\system32\umpnpmgr.dll |
| c:\windows\system32\pnrpauto.dll |
| c:\windows\system32\polstore.dll |
| c:\windows\system32\umpo.dll |
| c:\windows\system32\profsvc.dll |
| c:\windows\system32\psbase.dll |
| c:\windows\system32\drivers\pacer.sys |
| c:\windows\system32\qwave.dll |
| c:\windows\system32\drivers\qwavedrv.sys |
| c:\windows\system32\rasauto.dll |
| c:\windows\system32\rasmans.dll |
| c:\windows\system32\sstpsvc.dll |
| c:\windows\system32\drivers\rdpcdd.sys |
| c:\windows\system32\drivers\rdpencdd.sys |
| c:\windows\system32\drivers\rdprefmp.sys |
| c:\windows\system32\mprdim.dll |
| c:\windows\system32\regsvc.dll |
| c:\windows\system32\rpcepmap.dll |
| c:\windows\system32\locator.exe |
| c:\windows\system32\samsrv.dll |
| c:\windows\system32\scardsvr.dll |
| c:\windows\system32\drivers\scfilter.sys |
| c:\windows\system32\schedsvc.dll |
| c:\windows\system32\sdrsvc.dll |
| c:\windows\system32\seclogon.dll |
| c:\windows\system32\sens.dll |
| c:\windows\system32\sensrsvc.dll |
| c:\windows\system32\sessenv.dll |
| c:\windows\system32\ipnathlp.dll |
| c:\windows\system32\shsvcs.dll |
| c:\windows\system32\tcpipcfg.dll |
| c:\windows\system32\snmptrap.exe |
| c:\windows\system32\spoolsv.exe |
| c:\windows\system32\sppsvc.exe |
| c:\windows\system32\sppuinotify.dll |
| c:\windows\system32\ssdpsrv.dll |
| c:\windows\system32\wiaservc.dll |
| c:\windows\system32\vmstorfltres.dll |
| c:\windows\system32\storsvc.dll |
| c:\windows\system32\swprv.dll |
| c:\windows\system32\sysmain.dll |
| c:\windows\system32\tabsvc.dll |
| c:\windows\system32\tapisrv.dll |
| c:\windows\system32\termsrv.dll |
| c:\windows\system32\themeservice.dll |
| c:\windows\system32\trkwks.dll |
| c:\windows\servicing\trustedinstaller.exe |
| c:\windows\system32\drivers\tssecsrv.sys |
| c:\windows\system32\ui0detect.exe |
| c:\windows\system32\umrdp.dll |
| c:\windows\system32\upnphost.dll |
| c:\windows\system32\dwm.exe |
| c:\windows\system32\vaultsvc.dll |
| c:\windows\system32\vds.exe |
| c:\windows\system32\drivers\volmgrx.sys |
| c:\windows\system32\vssvc.exe |
| c:\windows\system32\drivers\vwifibus.sys |
| c:\windows\system32\wbengine.exe |
| c:\windows\system32\wbiosrvc.dll |
| c:\windows\system32\wcncsvc.dll |
| c:\windows\system32\wcspluginservice.dll |
| c:\windows\system32\drivers\wdf01000.sys |
| c:\windows\system32\wdi.dll |
| c:\windows\system32\wecsvc.dll |
| c:\windows\system32\wercplsupport.dll |
| c:\windows\system32\wersvc.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\wbem\wmisvc.dll |
| c:\windows\system32\wsmsvc.dll |
| c:\windows\system32\wlansvc.dll |
| c:\program files\windows media player\wmpnetwk.exe |
| c:\windows\system32\wpcsvc.dll |
| c:\windows\system32\wpdbusenum.dll |
| c:\windows\system32\drivers\ws2ifsl.sys |
| c:\windows\system32\wscsvc.dll |
| c:\windows\system32\drivers\wudfpf.sys |
| c:\windows\system32\wudfsvc.dll |
| c:\windows\system32\wwansvc.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\taskhost.exe |
- PID
- 456
- CMD
- C:\Windows\system32\svchost.exe -k netsvcs
- Path
- C:\Windows\System32\svchost.exe
- Indicators
- Parent process
- services.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Version:
- Company
- Microsoft Corporation
- Description
- Host Process for Windows Services
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\svchost.exe |
| c:\windows\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\mmcss.dll |
| c:\windows\system32\avrt.dll |
| c:\windows\system32\gpsvc.dll |
| c:\windows\system32\gpapi.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\wevtapi.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\sysntfy.dll |
| c:\windows\system32\nlaapi.dll |
| c:\windows\system32\profsvc.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\atl.dll |
| c:\windows\system32\dsrole.dll |
| c:\windows\system32\themeservice.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\samlib.dll |
| c:\windows\system32\shsvcs.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\schedsvc.dll |
| c:\windows\system32\pcwum.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\authz.dll |
| c:\windows\system32\ubpm.dll |
| c:\windows\system32\ktmw32.dll |
| c:\windows\system32\xmllite.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\credssp.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\fveapi.dll |
| c:\windows\system32\tbs.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\fvecerts.dll |
| c:\windows\system32\bcryptprimitives.dll |
| c:\windows\system32\wiarpc.dll |
| c:\windows\system32\taskcomp.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\netjoin.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\wbem\wmisvc.dll |
| c:\windows\system32\wbemcomn.dll |
| c:\windows\system32\vssapi.dll |
| c:\windows\system32\vsstrace.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpsvc.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\firewallapi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\fwpuclnt.dll |
| c:\windows\system32\rtutils.dll |
| c:\windows\system32\sqmapi.dll |
| c:\windows\system32\wdscore.dll |
| c:\windows\system32\es.dll |
| c:\windows\system32\netcfgx.dll |
| c:\windows\system32\hnetcfg.dll |
| c:\windows\system32\devrtl.dll |
| c:\windows\system32\wbem\wbemprox.dll |
| c:\windows\system32\wbem\wbemcore.dll |
| c:\windows\system32\wbem\esscli.dll |
| c:\windows\system32\wbem\fastprox.dll |
| c:\windows\system32\ntdsapi.dll |
| c:\windows\system32\netprofm.dll |
| c:\windows\system32\nci.dll |
| c:\windows\system32\wbem\wbemsvc.dll |
| c:\windows\system32\wbem\wmiutils.dll |
| c:\windows\system32\dnsapi.dll |
| c:\windows\system32\wbem\repdrvfs.dll |
| c:\windows\system32\wbem\wmiprvsd.dll |
| c:\windows\system32\ncobjapi.dll |
| c:\windows\system32\wbem\wbemess.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\sens.dll |
| c:\windows\apppatch\acpsens.dll |
| c:\windows\system32\srvsvc.dll |
| c:\windows\system32\browser.dll |
| c:\windows\system32\rasadhlp.dll |
| c:\windows\system32\netmsg.dll |
| c:\windows\system32\sscore.dll |
| c:\windows\system32\clusapi.dll |
| c:\windows\system32\cryptdll.dll |
| c:\windows\system32\resutils.dll |
| c:\windows\system32\dhcpcsvc6.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\aelupsvc.dll |
| c:\windows\system32\npmproxy.dll |
| c:\windows\system32\actxprxy.dll |
| c:\windows\system32\wbem\ncprov.dll |
- PID
- 460
- CMD
- "C:\Windows\SysWOW64\svchost.exe" -k NetworkService
- Path
- C:\Windows\SysWOW64\svchost.exe
- Indicators
- No indicators
- Parent process
- services.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Host Process for Windows Services
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\svchost.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\syswow64\apphelp.dll |
- PID
- 424
- CMD
- "C:\Windows\SysWOW64\svchost.exe" -k LocalService
- Path
- C:\Windows\SysWOW64\svchost.exe
- Indicators
- Parent process
- services.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Version:
- Company
- Microsoft Corporation
- Description
- Host Process for Windows Services
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\svchost.exe |
| c:\windows\system32\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\syswow64\ntdll.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\syswow64\wsock32.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\wininet.dll |
| c:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll |
| c:\windows\syswow64\normaliz.dll |
| c:\windows\syswow64\iertutil.dll |
| c:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\wshtcpip.dll |
| c:\windows\syswow64\ntmarta.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\wintrust.dll |
| c:\windows\syswow64\crypt32.dll |
| c:\windows\syswow64\msasn1.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\netbios.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\napinsp.dll |
| c:\windows\syswow64\pnrpnsp.dll |
| c:\windows\syswow64\winrnr.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\rasadhlp.dll |
| c:\windows\syswow64\secur32.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\api-ms-win-downlevel-advapi32-l2-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\wship6.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\netprofm.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\npmproxy.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\wshqos.dll |
| c:\windows\syswow64\urlmon.dll |
- PID
- 1028
- CMD
- "C:\Windows\SysWOW64\svchost.exe" -k NetworkService
- Path
- C:\Windows\SysWOW64\svchost.exe
- Indicators
- Parent process
- services.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Version:
- Company
- Microsoft Corporation
- Description
- Host Process for Windows Services
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\svchost.exe |
| c:\windows\system32\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\syswow64\ntdll.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\wsock32.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\wshtcpip.dll |
| c:\windows\syswow64\apphelp.dll |
| c:\windows\syswow64\powercfg.exe |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\napinsp.dll |
| c:\windows\syswow64\pnrpnsp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\winrnr.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\rasadhlp.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\wininet.dll |
| c:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll |
| c:\windows\syswow64\normaliz.dll |
| c:\windows\syswow64\iertutil.dll |
| c:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll |
| c:\windows\syswow64\userenv.dll |
| c:\windows\syswow64\profapi.dll |
| c:\windows\syswow64\secur32.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\api-ms-win-downlevel-advapi32-l2-1-0.dll |
| c:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll |
| c:\windows\syswow64\winhttp.dll |
| c:\windows\syswow64\webio.dll |
| c:\windows\syswow64\wship6.dll |
| c:\windows\syswow64\clbcatq.dll |
| c:\windows\syswow64\netprofm.dll |
| c:\windows\syswow64\dhcpcsvc6.dll |
| c:\windows\syswow64\dhcpcsvc.dll |
| c:\windows\syswow64\cryptsp.dll |
| c:\windows\syswow64\rsaenh.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll |
| c:\windows\syswow64\rpcrtremote.dll |
| c:\windows\syswow64\npmproxy.dll |
| c:\windows\syswow64\wshqos.dll |
| c:\windows\syswow64\urlmon.dll |
- PID
- 912
- CMD
- "taskhost.exe"
- Path
- C:\Windows\system32\taskhost.exe
- Indicators
- No indicators
- Parent process
- services.exe
- User
- admin
- Integrity Level
- MEDIUM
- Version:
- Company
- Microsoft Corporation
- Description
- Host Process for Windows Tasks
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\taskhost.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\msctfmonitor.dll |
| c:\windows\system32\msutb.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll |
| c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll |
| c:\windows\system32\normaliz.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll |
| c:\windows\system32\playsndsrv.dll |
| c:\windows\system32\hotstartuseragent.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\esent.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\winmm.dll |
- PID
- 2824
- CMD
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
- Path
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
- Indicators
- No indicators
- Parent process
- services.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- .NET Runtime Optimization Service
- Version
- 4.7.3062.0 built by: NET472REL1
Modules
| Image |
|---|
| c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\msvcr120_clr0400.dll |
| c:\windows\syswow64\mscoree.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
- PID
- 1944
- CMD
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
- Path
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
- Indicators
- No indicators
- Parent process
- services.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- .NET Runtime Optimization Service
- Version
- 4.7.3062.0 built by: NET472REL1
Modules
| Image |
|---|
| c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\msvcr120_clr0400.dll |
| c:\windows\system32\mscoree.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
- PID
- 1104
- CMD
- C:\Windows\system32\sppsvc.exe
- Path
- C:\Windows\system32\sppsvc.exe
- Indicators
- No indicators
- Parent process
- services.exe
- User
- NETWORK SERVICE
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Microsoft Software Protection Platform Service
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\sppsvc.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\sppwinob.dll |
| c:\windows\system32\sppobjs.dll |
| c:\windows\system32\dnsapi.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\taskschd.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
- PID
- 2740
- CMD
- POWERCFG -H OFF
- Path
- C:\Windows\SysWOW64\POWERCFG.exe
- Indicators
- No indicators
- Parent process
- svchost.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Power Settings Command-Line Tool
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\powercfg.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\shlwapi.dll |
| c:\windows\syswow64\shell32.dll |
| c:\windows\syswow64\powrprof.dll |
| c:\windows\syswow64\setupapi.dll |
| c:\windows\syswow64\cfgmgr32.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\devobj.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
- PID
- 1868
- CMD
- C:\Windows\system32\sc.exe start w32time task_started
- Path
- C:\Windows\system32\sc.exe
- Indicators
- No indicators
- Parent process
- services.exe
- User
- LOCAL SERVICE
- Integrity Level
- SYSTEM
- Exit code
- 1058
- Version:
- Company
- Microsoft Corporation
- Description
- A tool to aid in developing services for WindowsNT
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
- PID
- 2004
- CMD
- wmiadap.exe /F /T /R
- Path
- C:\Windows\system32\wbem\WMIADAP.EXE
- Indicators
- No indicators
- Parent process
- svchost.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- WMI Reverse Performance Adapter Maintenance Utility
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\wbem\wmiadap.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\wbemcomn.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\loadperf.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\wbem\wbemprox.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\wbem\wbemsvc.dll |
| c:\windows\system32\wbem\fastprox.dll |
| c:\windows\system32\ntdsapi.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
- PID
- 2316
- CMD
- C:\Windows\System32\svchost.exe -k rpcss
- Path
- C:\Windows\System32\svchost.exe
- Indicators
- Parent process
- svchost.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Host Process for Windows Services
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\svchost.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\wshqos.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2352
- CMD
- C:\Windows\SysWOW64\svchost.exe -k rpcss
- Path
- C:\Windows\SysWOW64\svchost.exe
- Indicators
- Parent process
- services.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Version:
- Company
- Microsoft Corporation
- Description
- Host Process for Windows Services
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\syswow64\svchost.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\systemroot\syswow64\ntdll.dll |
| c:\windows\system32\wow64.dll |
| c:\windows\system32\wow64win.dll |
| c:\windows\system32\wow64cpu.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\syswow64\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\syswow64\kernelbase.dll |
| c:\windows\syswow64\oleaut32.dll |
| c:\windows\syswow64\ole32.dll |
| c:\windows\syswow64\gdi32.dll |
| c:\windows\syswow64\msvcrt.dll |
| c:\windows\syswow64\advapi32.dll |
| c:\windows\syswow64\user32.dll |
| c:\windows\syswow64\sechost.dll |
| c:\windows\syswow64\rpcrt4.dll |
| c:\windows\syswow64\sspicli.dll |
| c:\windows\syswow64\cryptbase.dll |
| c:\windows\syswow64\lpk.dll |
| c:\windows\syswow64\usp10.dll |
| c:\windows\syswow64\version.dll |
| c:\windows\syswow64\netapi32.dll |
| c:\windows\syswow64\netutils.dll |
| c:\windows\syswow64\srvcli.dll |
| c:\windows\syswow64\wkscli.dll |
| c:\windows\syswow64\wsock32.dll |
| c:\windows\syswow64\ws2_32.dll |
| c:\windows\syswow64\nsi.dll |
| c:\windows\syswow64\imm32.dll |
| c:\windows\syswow64\msctf.dll |
| c:\windows\syswow64\winmm.dll |
| c:\windows\syswow64\mswsock.dll |
| c:\windows\syswow64\wshtcpip.dll |
| c:\windows\syswow64\ntmarta.dll |
| c:\windows\syswow64\wldap32.dll |
| c:\windows\syswow64\nlaapi.dll |
| c:\windows\syswow64\napinsp.dll |
| c:\windows\syswow64\pnrpnsp.dll |
| c:\windows\syswow64\dnsapi.dll |
| c:\windows\syswow64\winrnr.dll |
| c:\windows\syswow64\iphlpapi.dll |
| c:\windows\syswow64\winnsi.dll |
| c:\windows\syswow64\fwpuclnt.dll |
| c:\windows\syswow64\rasadhlp.dll |
- PID
- 4036
- CMD
- C:\Windows\System32\svchost.exe -k rpcss
- Path
- C:\Windows\System32\svchost.exe
- Indicators
- Parent process
- svchost.exe
- User
- SYSTEM
- Integrity Level
- SYSTEM
- Version:
- Company
- Microsoft Corporation
- Description
- Host Process for Windows Services
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\svchost.exe |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\wshqos.dll |
| c:\windows\system32\bcryptprimitives.dll |
Registry activity
Total events
18306
Read events
16667
Write events
1631
Delete events
8
Modification events
PID
Process
Operation
Key
Name
Value
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
ShellExtBMP
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
ShellExtIcon
2696
WinRAR.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
0
C:\Users\admin\Desktop\pf.zip
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
name
120
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
size
80
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
type
120
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
mtime
100
2696
WinRAR.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
@C:\Windows\System32\msimsg.dll,-34
Windows Installer Package
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Placement
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1600000016000000D60300000B020000
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\Microsoft\IMEJP\10.0\MSIME\AutoCharWidth
LearnData
A2,040,050,060,070,080,090,160,170,
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\General
LastFolder
C:\Users\admin\Desktop
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
name
120
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
size
80
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
psize
80
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
type
120
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
mtime
100
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
crc
70
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\General\Toolbar\Layout
Band76_0
4C000000730100000402000000000000D4D0C80000000000000000000000000000000000000000004E010400000000000000000039000000B402000000000000000000000000000001000000
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\General\Toolbar\Layout
Band76_1
4C000000730100000500000000000000D4D0C80000000000000000000000000000000000000000005C0104000000000000000000160000002A00000000000000000000000000000002000000
2696
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\General\Toolbar\Layout
Band76_2
4C000000730100000400000000000000D4D0C8000000000000000000000000000000000000000000440107000000000000000000160000006400000000000000000000000000000003000000
2176
msiexec.exe
write
HKEY_CURRENT_USER\Software\Microsoft\IMEJP\10.0\MSIME\AutoCharWidth
LearnData
A2,040,050,060,070,080,090,160,170,
2964
msiexec.exe
delete key
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
(default)
2964
msiexec.exe
delete key
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B
(default)
2964
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
(default)
2964
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback
(default)
2964
msiexec.exe
delete key
HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000\Software\Microsoft\RestartManager\Session0000
(default)
2964
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
(default)
2964
msiexec.exe
write
HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000\Software\Microsoft\RestartManager\Session0000
Owner
940B00008844F9EECFC0D601
2964
msiexec.exe
write
HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000\Software\Microsoft\RestartManager\Session0000
SessionHash
CBCF4BFF4018671F6C2D071A9B0E0C1FA531F750FEBB65CBB93BD0730E1660E4
2964
msiexec.exe
write
HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000\Software\Microsoft\RestartManager\Session0000
Sequence
1
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
(default)
C:\Windows\Installer\18653f.ipi
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Config.Msi\
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\186540.rbs
30851355
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\186540.rbsLow
1623513920
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B7B00AA4731E2647AAC15042EA5873C
230593080361B4C49A79A0C7BC277CB5
C:\Windows\AppPatch\Custom\
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\70BF55C3EB8F6EA41939DB875DE7E060
230593080361B4C49A79A0C7BC277CB5
C:\Windows\.ini
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files (x86)\9LFHGFHUAXLNF5ATC8AWC1H6VEYA0VFUFFY5\9LFHGFHUAXLNF5ATC8AWC1H6VEYA0VFUFFY5\
1
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files (x86)\9LFHGFHUAXLNF5ATC8AWC1H6VEYA0VFUFFY5\
1
2964
msiexec.exe
write
HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000\Software\Policies\Microsoft\Windows Defender
DisableAntiSpyware
1
2964
msiexec.exe
write
HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000\Software\7-Zip
StayOnTop
1
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
DisableAntiSpyware
1
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER
AllowProtectedRenames
1
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER
PendingFileRenameOperations
\??\C:\Windows\AppPatch\Acpsens.dll
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\SoundResearch
UpdaterLastTimeChecked1
1
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\SoundResearch
UpdaterLastTimeChecked2
2
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\SoundResearch
UpdaterLastTimeChecked3
3
2964
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings
StringCacheGeneration
316
1736
MsiExec.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings
JITDebug
0
1736
MsiExec.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
1736
MsiExec.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2932
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
1460
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
className
ipsecISAKMPPolicy
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
name
ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
ipsecID
{03b677df-e230-4e22-817b-873a2e245c69}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
ipsecDataType
256
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
ipsecData
B820DC80C82ED111A89E00A0248D3021C0000000DF77B60330E2224E817B873A2E245C69000000000000000000000000000000000000000080700000000000000000000000000000000000000000000002000000000000000300000040000000080000000200000040000000000000000000000000000000000000000000000002000000000000000000000080700000000000000000000003000000400000000800000002000000400000000000000000000000000000000400000000000000020000000000000000000000807000000000000000
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
whenChanged
1606050240
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
className
ipsecNegotiationPolicy
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
name
ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
ipsecID
{17512265-c29d-4ee6-82d7-727237198fea}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
ipsecNegotiationPolicyAction
{8a171dd3-77e3-11d1-8659-a04f00000000}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
ipsecNegotiationPolicyType
{62f49e13-6c37-11d1-864c-14a300000000}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
ipsecDataType
256
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
ipsecData
B920DC80C82ED111A89E00A0248D3021A4000000020000000000000000000000000000000000000001000000030000000200000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
whenChanged
1606050241
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
className
ipsecPolicy
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
name
ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
ipsecName
qianye
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
ipsecID
{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
ipsecDataType
256
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
ipsecData
632120224C4FD111863B00A0248D302104000000302A000000
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
ipsecISAKMPReference
SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
whenChanged
1606050240
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecISAKMPPolicy{03b677df-e230-4e22-817b-873a2e245c69}
ipsecOwnersReference
SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
className
ipsecNFA
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
name
ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
ipsecID
{5a7ce80b-f959-4249-b17e-9bed6ec47221}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
ipsecDataType
256
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
ipsecData
00ACBB118D49D111863900A0248D30212A0000000100000005000000020000000000FDFFFFFF0200000000000000000000000000000000000200000000000101010101010101010101010101010101000000050000000000000001010101010101010101010101010102010000000000000000
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
ipsecNegotiationPolicyReference
SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
whenChanged
1606050241
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
ipsecNFAReference
SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
ipsecOwnersReference
SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{5e9db8e8-9fab-4d45-ad31-5289b6b52b51}
1460
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNegotiationPolicy{17512265-c29d-4ee6-82d7-727237198fea}
ipsecOwnersReference
SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecNFA{5a7ce80b-f959-4249-b17e-9bed6ec47221}
2888
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
2888
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
className
ipsecFilter
2888
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
name
ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
2888
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecName
Filter1
2888
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecID
{9769c0ef-ec05-4236-8489-774fff32c934}
2888
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecDataType
256
2888
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecData
B520DC80C82ED111A89E00A0248D30210000000000000000
2888
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
whenChanged
1606050241
2780
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
2780
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
className
ipsecFilter
2780
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
name
ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
2780
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecName
Filter1
2780
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecID
{9769c0ef-ec05-4236-8489-774fff32c934}
2780
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecDataType
256
2780
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecData
B520DC80C82ED111A89E00A0248D30214600000001000000020000000000020000000000020000000000DBF4B75726E05D4BA12D9C8BC66B7D0001000000000000000000000000000000FFFFFFFF00000000060000000000BD0100000000
2780
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
whenChanged
1606050242
2596
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
2596
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
className
ipsecFilter
2596
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
name
ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
2596
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecName
Filter1
2596
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecID
{9769c0ef-ec05-4236-8489-774fff32c934}
2596
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecDataType
256
2596
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecData
B520DC80C82ED111A89E00A0248D30218C00000002000000020000000000020000000000020000000000DBF4B75726E05D4BA12D9C8BC66B7D0001000000000000000000000000000000FFFFFFFF00000000060000000000BD0100000000020000000000020000000000020000000000D5BFE22ABD9C214B89565EEE3CEA1F9D01000000000000000000000000000000FFFFFFFF00000000060000000000870000000000
2596
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
whenChanged
1606050243
2800
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
2800
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
className
ipsecFilter
2800
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
name
ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
2800
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecName
Filter1
2800
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecID
{9769c0ef-ec05-4236-8489-774fff32c934}
2800
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecDataType
256
2800
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecData
B520DC80C82ED111A89E00A0248D3021D200000003000000020000000000020000000000020000000000DBF4B75726E05D4BA12D9C8BC66B7D0001000000000000000000000000000000FFFFFFFF00000000060000000000BD0100000000020000000000020000000000020000000000D5BFE22ABD9C214B89565EEE3CEA1F9D01000000000000000000000000000000FFFFFFFF00000000060000000000870000000000020000000000020000000000020000000000D9BAF2D851F4544891581B505D8E8A0401000000000000000000000000000000FFFFFFFF000000000600000000008B0000000000
2800
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
whenChanged
1606050242
2212
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
2212
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
className
ipsecFilter
2212
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
name
ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
2212
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecName
Filter1
2212
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecID
{9769c0ef-ec05-4236-8489-774fff32c934}
2212
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecDataType
256
2212
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecData
B520DC80C82ED111A89E00A0248D30211801000004000000020000000000020000000000020000000000DBF4B75726E05D4BA12D9C8BC66B7D0001000000000000000000000000000000FFFFFFFF00000000060000000000BD0100000000020000000000020000000000020000000000D5BFE22ABD9C214B89565EEE3CEA1F9D01000000000000000000000000000000FFFFFFFF00000000060000000000870000000000020000000000020000000000020000000000D9BAF2D851F4544891581B505D8E8A0401000000000000000000000000000000FFFFFFFF000000000600000000008B0000000000020000000000020000000000020000000000C3CA079C0FBCBF4E9C6F83108F3B3AF401000000000000000000000000000000FFFFFFFF00000000110000000000BD0100000000
2212
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
whenChanged
1606050243
3048
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
3048
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
className
ipsecFilter
3048
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
name
ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
3048
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecName
Filter1
3048
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecID
{9769c0ef-ec05-4236-8489-774fff32c934}
3048
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecDataType
256
3048
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecData
B520DC80C82ED111A89E00A0248D30215E01000005000000020000000000020000000000020000000000DBF4B75726E05D4BA12D9C8BC66B7D0001000000000000000000000000000000FFFFFFFF00000000060000000000BD0100000000020000000000020000000000020000000000D5BFE22ABD9C214B89565EEE3CEA1F9D01000000000000000000000000000000FFFFFFFF00000000060000000000870000000000020000000000020000000000020000000000D9BAF2D851F4544891581B505D8E8A0401000000000000000000000000000000FFFFFFFF000000000600000000008B0000000000020000000000020000000000020000000000C3CA079C0FBCBF4E9C6F83108F3B3AF401000000000000000000000000000000FFFFFFFF00000000110000000000BD010000000002000000000002000000000002000000000091BE689CD16E9F418EAF172D3A55A4F801000000000000000000000000000000FFFFFFFF00000000110000000000870000000000
3048
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
whenChanged
1606050244
2760
netsh.exe
write
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\13B\52C64B7E
LanguageList
en-US
2760
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
className
ipsecFilter
2760
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
name
ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
2760
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecName
Filter1
2760
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecID
{9769c0ef-ec05-4236-8489-774fff32c934}
2760
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecDataType
256
2760
netsh.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecFilter{9769c0ef-ec05-4236-8489-774fff32c934}
ipsecData
B520DC80C82ED111A89E00A0248D3021A401000006000000020000000000020000000000020000000000DBF4B75726E05D4BA12D9C8BC66B7D0001000000000000000000000000000000FFFFFFFF00000000060000000000BD0100000000020000000000020000000000020000000000D5BFE22ABD9C214B89565EEE3CEA1F9D01000000000000000000000000000000FFFFFFFF00000000060000000000870000000000020000000000020000000000020000000000D9BAF2D851F4544891581B505D8E8A0401000000000000000000000000000