VMRay Analyzer Report
Involved Hosts

HostResolved toCountryCityProtocol
ipinfo.io52.57.214.72USWilmingtonHTTP
127.0.0.1
85.93.0.0DEUDP
85.93.0.1DEUDP
85.93.0.2DEUDP
85.93.0.3DEUDP
85.93.0.4DEUDP
85.93.0.5DEUDP
85.93.0.6DEUDP
85.93.0.7DEUDP
85.93.0.8DEUDP
85.93.0.9DEUDP
85.93.0.10DEUDP
85.93.0.11DEUDP
85.93.0.12DEUDP
85.93.0.13DEUDP
85.93.0.14DEUDP
85.93.0.15DEUDP
85.93.0.16DEUDP
85.93.0.17DEUDP
85.93.0.18DEUDP
85.93.0.19DEUDP
85.93.0.20DEUDP
85.93.0.21DEUDP
85.93.0.22DEUDP
85.93.0.23DEUDP
85.93.0.24DEUDP
85.93.0.25DEUDP
85.93.0.26DEUDP
85.93.0.27DEUDP
85.93.0.28DEUDP
85.93.0.29DEUDP
85.93.0.30DEUDP
85.93.0.31DEUDP
85.93.0.32DEUDP
85.93.0.33DEUDP
85.93.0.34DEUDP
85.93.0.35DEUDP
85.93.0.36DEUDP
85.93.0.37DEUDP
85.93.0.38DEUDP
85.93.0.39DEUDP
85.93.0.40DEUDP
85.93.0.41DEUDP
85.93.0.42DEUDP
85.93.0.43DEUDP
85.93.0.44DEUDP
85.93.0.45DEUDP
85.93.0.46DEUDP
85.93.0.47DEUDP
85.93.0.48DEUDP
85.93.0.49DEUDP
85.93.0.50DEUDP
85.93.0.51DEUDP
85.93.0.52DEUDP
85.93.0.53DEUDP
85.93.0.54DEUDP
85.93.0.55DEUDP
85.93.0.56DEUDP
85.93.0.57DEUDP
85.93.0.58DEUDP
85.93.0.59DEUDP
85.93.0.60DEUDP
85.93.0.61DEUDP
85.93.0.62DEUDP
85.93.0.63DEUDP
85.93.0.64DEUDP
85.93.0.65DEUDP
85.93.0.66DEUDP
85.93.0.67DEUDP
85.93.0.68DEUDP
85.93.0.69DEUDP
85.93.0.70DEUDP
85.93.0.71DEUDP
85.93.0.72DEUDP
85.93.0.73DEUDP
85.93.0.74DEUDP
85.93.0.75DEUDP
85.93.0.76DEUDP
85.93.0.77DEUDP
85.93.0.78DEUDP
85.93.0.79DEUDP
85.93.0.80DEUDP
85.93.0.81DEUDP
85.93.0.82DEUDP
85.93.0.83DEUDP
85.93.0.84DEUDP
85.93.0.85DEUDP
85.93.0.86DEUDP
85.93.0.87DEUDP
85.93.0.88DEUDP
85.93.0.89DEUDP
85.93.0.90DEUDP
85.93.0.91DEUDP
85.93.0.92DEUDP
85.93.0.93DEUDP
85.93.0.94DEUDP
85.93.0.95DEUDP
85.93.0.96DEUDP
85.93.0.97DEUDP
85.93.0.98DEUDP
85.93.0.99DEUDP
85.93.0.100DEUDP
85.93.0.101DEUDP
85.93.0.102DEUDP
85.93.0.103DEUDP
85.93.0.104DEUDP
85.93.0.105DEUDP
85.93.0.106DEUDP
85.93.0.107DEUDP
85.93.0.108DEUDP
85.93.0.109DEUDP
85.93.0.110DEUDP
85.93.0.111DEUDP
85.93.0.112DEUDP
85.93.0.113DEUDP
85.93.0.114DEUDP
85.93.0.115DEUDP
85.93.0.116DEUDP
85.93.0.117DEUDP
85.93.0.118DEUDP
85.93.0.119DEUDP
85.93.0.120DEUDP
85.93.0.121DEUDP
85.93.0.122DEUDP
85.93.0.123DEUDP
85.93.0.124DEUDP
85.93.0.125DEUDP
85.93.0.126DEUDP
85.93.0.127DEUDP
85.93.0.128DEUDP
85.93.0.129DEUDP
85.93.0.130DEUDP
85.93.0.131DEUDP
85.93.0.132DEUDP
85.93.0.133DEUDP
85.93.0.134DEUDP
85.93.0.135DEUDP
85.93.0.136DEUDP
85.93.0.137DEUDP
85.93.0.138DEUDP
85.93.0.139DEUDP
85.93.0.140DEUDP
85.93.0.141DEUDP
85.93.0.142DEUDP
85.93.0.143DEUDP
85.93.0.144DEUDP
85.93.0.145DEUDP
85.93.0.146DEUDP
85.93.0.147DEUDP
85.93.0.148DEUDP
85.93.0.149DEUDP
85.93.0.150DEUDP
85.93.0.151DEUDP
85.93.0.152DEUDP
85.93.0.153DEUDP
85.93.0.154DEUDP
85.93.0.155DEUDP
85.93.0.156DEUDP
85.93.0.157DEUDP
85.93.0.158DEUDP
85.93.0.159DEUDP
85.93.0.160DEUDP
85.93.0.161DEUDP
85.93.0.162DEUDP
85.93.0.163DEUDP
85.93.0.164DEUDP
85.93.0.165DEUDP
85.93.0.166DEUDP
85.93.0.167DEUDP
85.93.0.168DEUDP
85.93.0.169DEUDP
85.93.0.170DEUDP
85.93.0.171DEUDP
85.93.0.172DEUDP
85.93.0.173DEUDP
85.93.0.174DEUDP
85.93.0.175DEUDP
85.93.0.176DEUDP
85.93.0.177DEUDP
85.93.0.178DEUDP
85.93.0.179DEUDP
85.93.0.180DEUDP
85.93.0.181DEUDP
85.93.0.182DEUDP
85.93.0.183DEUDP
85.93.0.184DEUDP
85.93.0.185DEUDP
85.93.0.186DEUDP
85.93.0.187DEUDP
85.93.0.188DEUDP
85.93.0.189DEUDP
85.93.0.190DEUDP
85.93.0.191DEUDP
85.93.0.192DEUDP
85.93.0.193DEUDP
85.93.0.194DEUDP
85.93.0.195DEUDP
85.93.0.196DEUDP
85.93.0.197DEUDP
85.93.0.198DEUDP
85.93.0.199DEUDP
85.93.0.200DEUDP
85.93.0.201DEUDP
85.93.0.202DEUDP
85.93.0.203DEUDP
85.93.0.204DEUDP
85.93.0.205DEUDP
85.93.0.206DEUDP
85.93.0.207DEUDP
85.93.0.208DEUDP
85.93.0.209DEUDP
85.93.0.210DEUDP
85.93.0.211DEUDP
85.93.0.212DEUDP
85.93.0.213DEUDP
85.93.0.214DEUDP
85.93.0.215DEUDP
85.93.0.216DEUDP
85.93.0.217DEUDP
85.93.0.218DEUDP
85.93.0.219DEUDP
85.93.0.220DEUDP
85.93.0.221DEUDP
85.93.0.222DEUDP
85.93.0.223DEUDP
85.93.0.224DEUDP
85.93.0.225DEUDP
85.93.0.226DEUDP
85.93.0.227DEUDP
85.93.0.228DEUDP
85.93.0.229DEUDP
85.93.0.230DEUDP
85.93.0.231DEUDP
85.93.0.232DEUDP
85.93.0.233DEUDP
85.93.0.234DEUDP
85.93.0.235DEUDP
85.93.0.236DEUDP
85.93.0.237DEUDP
85.93.0.238DEUDP
85.93.0.239DEUDP
85.93.0.240DEUDP
85.93.0.241DEUDP
85.93.0.242DEUDP
85.93.0.243DEUDP
85.93.0.244DEUDP
85.93.0.245DEUDP
85.93.0.246DEUDP
85.93.0.247DEUDP
85.93.0.248DEUDP
85.93.0.249DEUDP
85.93.0.250DEUDP
85.93.0.251DEUDP
85.93.0.252DEUDP
85.93.0.253DEUDP
85.93.0.254DEUDP
85.93.0.255DEUDP
85.93.1.0DEUDP
85.93.1.1DEUDP
85.93.1.2DEUDP
85.93.1.3DEUDP
85.93.1.4DEUDP
85.93.1.5DEUDP
85.93.1.6DEUDP
85.93.1.7DEUDP
85.93.1.8DEUDP
85.93.1.9DEUDP
85.93.1.10DEUDP
85.93.1.11DEUDP
85.93.1.12DEUDP
85.93.1.13DEUDP
85.93.1.14DEUDP
85.93.1.15DEUDP
85.93.1.16DEUDP
85.93.1.17DEUDP
85.93.1.18DEUDP
85.93.1.19DEUDP
85.93.1.20DEUDP
85.93.1.21DEUDP
85.93.1.22DEUDP
85.93.1.23DEUDP
85.93.1.24DEUDP
85.93.1.25DEUDP
85.93.1.26DEUDP
85.93.1.27DEUDP
85.93.1.28DEUDP
85.93.1.29DEUDP
85.93.1.30DEUDP
85.93.1.31DEUDP
85.93.1.32DEUDP
85.93.1.33DEUDP
85.93.1.34DEUDP
85.93.1.35DEUDP
85.93.1.36DEUDP
85.93.1.37DEUDP
85.93.1.38DEUDP
85.93.1.39DEUDP
85.93.1.40DEUDP
85.93.1.41DEUDP
85.93.1.42DEUDP
85.93.1.43DEUDP
85.93.1.44DEUDP
85.93.1.45DEUDP
85.93.1.46DEUDP
85.93.1.47DEUDP
85.93.1.48DEUDP
85.93.1.49DEUDP
85.93.1.50DEUDP
85.93.1.51DEUDP
85.93.1.52DEUDP
85.93.1.53DEUDP
85.93.1.54DEUDP
85.93.1.55DEUDP
85.93.1.56DEUDP
85.93.1.57DEUDP
85.93.1.58DEUDP
85.93.1.59DEUDP
85.93.1.60DEUDP
85.93.1.61DEUDP
85.93.1.62DEUDP
85.93.1.63DEUDP
85.93.1.64DEUDP
85.93.1.65DEUDP
85.93.1.66DEUDP
85.93.1.67DEUDP
85.93.1.68DEUDP
85.93.1.69DEUDP
85.93.1.70DEUDP
o14.okulhaberler.com85.93.1.71DEUDP
85.93.1.72DEUDP
85.93.1.73DEUDP
85.93.1.74DEUDP
85.93.1.75DEUDP
85.93.1.76DEUDP
85.93.1.77DEUDP
85.93.1.78DEUDP
85.93.1.79DEUDP
85.93.1.80DEUDP
85.93.1.81DEUDP
85.93.1.82DEUDP
85.93.1.83DEUDP
a7.afeastforyoureyes.com85.93.1.84DEUDP
85.93.1.85DEUDP
85.93.1.86DEUDP
85.93.1.87DEUDP
85.93.1.88DEUDP
85.93.1.89DEUDP
85.93.1.90DEUDP
85.93.1.91DEUDP
85.93.1.92DEUDP
85.93.1.93DEUDP
85.93.1.94DEUDP
85.93.1.95DEUDP
85.93.1.96DEUDP
85.93.1.97DEUDP
85.93.1.98DEUDP
85.93.1.99DEUDP
85.93.1.100DEUDP
85.93.1.101DEUDP
85.93.1.102DEUDP
85.93.1.103DEUDP
85.93.1.104DEUDP
85.93.1.105DEUDP
85.93.1.106DEUDP
85.93.1.107DEUDP
85.93.1.108DEUDP
85.93.1.109DEUDP
85.93.1.110DEUDP
85.93.1.111DEUDP
85.93.1.112DEUDP
85.93.1.113DEUDP
85.93.1.114DEUDP
85.93.1.115DEUDP
85.93.1.116DEUDP
85.93.1.117DEUDP
85.93.1.118DEUDP
85.93.1.119DEUDP
85.93.1.120DEUDP
85.93.1.121DEUDP
85.93.1.122DEUDP
85.93.1.123DEUDP
85.93.1.124DEUDP
85.93.1.125DEUDP
85.93.1.126DEUDP
85.93.1.127DEUDP
85.93.1.128DEUDP
85.93.1.129DEUDP
85.93.1.130DEUDP
85.93.1.131DEUDP
85.93.1.132DEUDP
85.93.1.133DEUDP
85.93.1.134DEUDP
85.93.1.135DEUDP
85.93.1.136DEUDP
85.93.1.137DEUDP
85.93.1.138DEUDP
85.93.1.139DEUDP
85.93.1.140DEUDP
85.93.1.141DEUDP
85.93.1.142DEUDP
85.93.1.143DEUDP
85.93.1.144DEUDP
85.93.1.145DEUDP
85.93.1.146DEUDP
85.93.1.147DEUDP
85.93.1.148DEUDP
85.93.1.149DEUDP
85.93.1.150DEUDP
c17.bshtrack.com85.93.1.151DEUDP
85.93.1.152DEUDP
85.93.1.153DEUDP
85.93.1.154DEUDP
85.93.1.155DEUDP
85.93.1.156DEUDP
85.93.1.157DEUDP
85.93.1.158DEUDP
85.93.1.159DEUDP
85.93.1.160DEUDP
85.93.1.161DEUDP
85.93.1.162DEUDP
85.93.1.163DEUDP
85.93.1.164DEUDP
85.93.1.165DEUDP
85.93.1.166DEUDP
85.93.1.167DEUDP
85.93.1.168DEUDP
85.93.1.169DEUDP
85.93.1.170DEUDP
85.93.1.171DEUDP
85.93.1.172DEUDP
85.93.1.173DEUDP
85.93.1.174DEUDP
85.93.1.175DEUDP
85.93.1.176DEUDP
85.93.1.177DEUDP
85.93.1.178DEUDP
85.93.1.179DEUDP
85.93.1.180DEUDP
85.93.1.181DEUDP
85.93.1.182DEUDP
85.93.1.183DEUDP
85.93.1.184DEUDP
85.93.1.185DEUDP
85.93.1.186DEUDP
85.93.1.187DEUDP
85.93.1.188DEUDP
85.93.1.189DEUDP
85.93.1.190DEUDP
85.93.1.191DEUDP
85.93.1.192DEUDP
85.93.1.193DEUDP
85.93.1.194DEUDP
85.93.1.195DEUDP
85.93.1.196DEUDP
85.93.1.197DEUDP
85.93.1.198DEUDP
85.93.1.199DEUDP
85.93.1.200DEUDP
85.93.1.201DEUDP
85.93.1.202DEUDP
85.93.1.203DEUDP
85.93.1.204DEUDP
85.93.1.205DEUDP
85.93.1.206DEUDP
85.93.1.207DEUDP
85.93.1.208DEUDP
85.93.1.209DEUDP
85.93.1.210DEUDP
85.93.1.211DEUDP
85.93.1.212DEUDP
85.93.1.213DEUDP
85.93.1.214DEUDP
85.93.1.215DEUDP
85.93.1.216DEUDP
85.93.1.217DEUDP
85.93.1.218DEUDP
85.93.1.219DEUDP
85.93.1.220DEUDP
85.93.1.221DEUDP
85.93.1.222DEUDP
85.93.1.223DEUDP
85.93.1.224DEUDP
85.93.1.225DEUDP
85.93.1.226DEUDP
85.93.1.227DEUDP
85.93.1.228DEUDP
85.93.1.229DEUDP
85.93.1.230DEUDP
85.93.1.231DEUDP
85.93.1.232DEUDP
85.93.1.233DEUDP
85.93.1.234DEUDP
85.93.1.235DEUDP
85.93.1.236DEUDP
85.93.1.237DEUDP
85.93.1.238DEUDP
85.93.1.239DEUDP
85.93.1.240DEUDP
85.93.1.241DEUDP
85.93.1.242DEUDP
85.93.1.243DEUDP
85.93.1.244DEUDP
85.93.1.245DEUDP
85.93.1.246DEUDP
85.93.1.247DEUDP
85.93.1.248DEUDP
85.93.1.249DEUDP
85.93.1.250DEUDP
85.93.1.251DEUDP
85.93.1.252DEUDP
85.93.1.253DEUDP
85.93.1.254DEUDP
85.93.1.255DEUDP
85.93.2.0DEUDP
85.93.2.1DEUDP
85.93.2.2DEUDP
85.93.2.3DEUDP
85.93.2.4DEUDP
85.93.2.5DEUDP
85.93.2.6DEUDP
85.93.2.7DEUDP
85.93.2.8DEUDP
85.93.2.9DEUDP
85.93.2.10DEUDP
85.93.2.11DEUDP
85.93.2.12DEUDP
85.93.2.13DEUDP
85.93.2.14DEUDP
85.93.2.15DEUDP
85.93.2.16DEUDP
85.93.2.17DEUDP
85.93.2.18DEUDP
85.93.2.19DEUDP
85.93.2.20DEUDP
85.93.2.21DEUDP
85.93.2.22DEUDP
85.93.2.23DEUDP
85.93.2.24DEUDP
85.93.2.25DEUDP
85.93.2.26DEUDP
85.93.2.27DEUDP
85.93.2.28DEUDP
85.93.2.29DEUDP
85.93.2.30DEUDP
85.93.2.31DEUDP
85.93.2.32DEUDP
85.93.2.33DEUDP
85.93.2.34DEUDP
85.93.2.35DEUDP
85.93.2.36DEUDP
85.93.2.37DEUDP
85.93.2.38DEUDP
85.93.2.39DEUDP
85.93.2.40DEUDP
85.93.2.41DEUDP
85.93.2.42DEUDP
85.93.2.43DEUDP
85.93.2.44DEUDP
85.93.2.45DEUDP
85.93.2.46DEUDP
85.93.2.47DEUDP
85.93.2.48DEUDP
85.93.2.49DEUDP
85.93.2.50DEUDP
85.93.2.51DEUDP
85.93.2.52DEUDP
85.93.2.53DEUDP
85.93.2.54DEUDP
85.93.2.55DEUDP
85.93.2.56DEUDP
85.93.2.57DEUDP
85.93.2.58DEUDP
85.93.2.59DEUDP
85.93.2.60DEUDP
85.93.2.61DEUDP
85.93.2.62DEUDP
85.93.2.63DEUDP
85.93.2.64DEUDP
85.93.2.65DEUDP
85.93.2.66DEUDP
85.93.2.67DEUDP
85.93.2.68DEUDP
85.93.2.69DEUDP
85.93.2.70DEUDP
85.93.2.71DEUDP
85.93.2.72DEUDP
85.93.2.73DEUDP
85.93.2.74DEUDP
85.93.2.75DEUDP
85.93.2.76DEUDP
85.93.2.77DEUDP
85.93.2.78DEUDP
85.93.2.79DEUDP
85.93.2.80DEUDP
85.93.2.81DEUDP
85.93.2.82DEUDP
85.93.2.83DEUDP
85.93.2.84DEUDP
85.93.2.85DEUDP
85.93.2.86DEUDP
85.93.2.87DEUDP
85.93.2.88DEUDP
85.93.2.89DEUDP
85.93.2.90DEUDP
85.93.2.91DEUDP
85.93.2.92DEUDP
85.93.2.93DEUDP
85.93.2.94DEUDP
85.93.2.95DEUDP
85.93.2.96DEUDP
85.93.2.97DEUDP
85.93.2.98DEUDP
85.93.2.99DEUDP
85.93.2.100DEUDP
85.93.2.101DEUDP
85.93.2.102DEUDP
85.93.2.103DEUDP
85.93.2.104DEUDP
85.93.2.105DEUDP
85.93.2.106DEUDP
85.93.2.107DEUDP
85.93.2.108DEUDP
85.93.2.109DEUDP
85.93.2.110DEUDP
85.93.2.111DEUDP
85.93.2.112DEUDP
85.93.2.113DEUDP
85.93.2.114DEUDP
85.93.2.115DEUDP
85.93.2.116DEUDP
85.93.2.117DEUDP
85.93.2.118DEUDP
85.93.2.119DEUDP
85.93.2.120DEUDP
85.93.2.121DEUDP
85.93.2.122DEUDP
85.93.2.123DEUDP
85.93.2.124DEUDP
85.93.2.125DEUDP
85.93.2.126DEUDP
85.93.2.127DEUDP
85.93.2.128DEUDP
85.93.2.129DEUDP
85.93.2.130DEUDP
85.93.2.131DEUDP
85.93.2.132DEUDP
85.93.2.133DEUDP
85.93.2.134DEUDP
85.93.2.135DEUDP
85.93.2.136DEUDP
85.93.2.137DEUDP
85.93.2.138DEUDP
85.93.2.139DEUDP
85.93.2.140DEUDP
85.93.2.141DEUDP
85.93.2.142DEUDP
85.93.2.143DEUDP
85.93.2.144DEUDP
85.93.2.145DEUDP
85.93.2.146DEUDP
85.93.2.147DEUDP
85.93.2.148DEUDP
85.93.2.149DEUDP
85.93.2.150DEUDP
85.93.2.151DEUDP
85.93.2.152DEUDP
85.93.2.153DEUDP
85.93.2.154DEUDP
85.93.2.155DEUDP
85.93.2.156DEUDP
85.93.2.157DEUDP
85.93.2.158DEUDP
85.93.2.159DEUDP
85.93.2.160DEUDP
85.93.2.161DEUDP
85.93.2.162DEUDP
85.93.2.163DEUDP
85.93.2.164DEUDP
85.93.2.165DEUDP
85.93.2.166DEUDP
85.93.2.167DEUDP
85.93.2.168DEUDP
85.93.2.169DEUDP
85.93.2.170DEUDP
85.93.2.171DEUDP
85.93.2.172DEUDP
85.93.2.173DEUDP
85.93.2.174DEUDP
85.93.2.175DEUDP
85.93.2.176DEUDP
85.93.2.177DEUDP
85.93.2.178DEUDP
85.93.2.179DEUDP
85.93.2.180DEUDP
85.93.2.181DEUDP
85.93.2.182DEUDP
85.93.2.183DEUDP
85.93.2.184DEUDP
85.93.2.185DEUDP
85.93.2.186DEUDP
85.93.2.187DEUDP
85.93.2.188DEUDP
85.93.2.189DEUDP
85.93.2.190DEUDP
85.93.2.191DEUDP
85.93.2.192DEUDP
85.93.2.193DEUDP
85.93.2.194DEUDP
85.93.2.195DEUDP
85.93.2.196DEUDP
85.93.2.197DEUDP
85.93.2.198DEUDP
85.93.2.199DEUDP
85.93.2.200DEUDP
85.93.2.201DEUDP
85.93.2.202DEUDP
85.93.2.203DEUDP
85.93.2.204DEUDP
85.93.2.205DEUDP
85.93.2.206DEUDP
85.93.2.207DEUDP
85.93.2.208DEUDP
85.93.2.209DEUDP
85.93.2.210DEUDP
85.93.2.211DEUDP
85.93.2.212DEUDP
85.93.2.213DEUDP
85.93.2.214DEUDP
85.93.2.215DEUDP
85.93.2.216DEUDP
85.93.2.217DEUDP
85.93.2.218DEUDP
85.93.2.219DEUDP
85.93.2.220DEUDP
85.93.2.221DEUDP
85.93.2.222DEUDP
85.93.2.223DEUDP
85.93.2.224DEUDP
85.93.2.225DEUDP
85.93.2.226DEUDP
85.93.2.227DEUDP
85.93.2.228DEUDP
85.93.2.229DEUDP
85.93.2.230DEUDP
85.93.2.231DEUDP
85.93.2.232DEUDP
85.93.2.233DEUDP
85.93.2.234DEUDP
85.93.2.235DEUDP
85.93.2.236DEUDP
85.93.2.237DEUDP
85.93.2.238DEUDP
85.93.2.239DEUDP
85.93.2.240DEUDP
85.93.2.241DEUDP
85.93.2.242DEUDP
85.93.2.243DEUDP
85.93.2.244DEUDP
85.93.2.245DEUDP
85.93.2.246DEUDP
85.93.2.247DEUDP
85.93.2.248DEUDP
85.93.2.249DEUDP
85.93.2.250DEUDP
85.93.2.251DEUDP
85.93.2.252DEUDP
85.93.2.253DEUDP
85.93.2.254DEUDP
85.93.2.255DEUDP
85.93.3.0DEUDP
85.93.3.1DEUDP
85.93.3.2DEUDP
85.93.3.3DEUDP
85.93.3.4DEUDP
85.93.3.5DEUDP
85.93.3.6DEUDP
85.93.3.7DEUDP
85.93.3.8DEUDP
85.93.3.9DEUDP
85.93.3.10DEUDP
85.93.3.11DEUDP
85.93.3.12DEUDP
85.93.3.13DEUDP
85.93.3.14DEUDP
85.93.3.15DEUDP
85.93.3.16DEUDP
85.93.3.17DEUDP
85.93.3.18DEUDP
85.93.3.19DEUDP
85.93.3.20DEUDP
85.93.3.21DEUDP
85.93.3.22DEUDP
85.93.3.23DEUDP
85.93.3.24DEUDP
85.93.3.25DEUDP
85.93.3.26DEUDP
85.93.3.27DEUDP
85.93.3.28DEUDP
85.93.3.29DEUDP
85.93.3.30DEUDP
85.93.3.31DEUDP
85.93.3.32DEUDP
85.93.3.33DEUDP
85.93.3.34DEUDP
85.93.3.35DEUDP
85.93.3.36DEUDP
host5.aceimportant.com85.93.3.37DEUDP
85.93.3.38DEUDP
85.93.3.39DEUDP
85.93.3.40DEUDP
85.93.3.41DEUDP
85.93.3.42DEUDP
85.93.3.43DEUDP
85.93.3.44DEUDP
85.93.3.45DEUDP
85.93.3.46DEUDP
85.93.3.47DEUDP
85.93.3.48DEUDP
85.93.3.49DEUDP
85.93.3.50DEUDP
85.93.3.51DEUDP
85.93.3.52DEUDP
85.93.3.53DEUDP
85.93.3.54DEUDP
85.93.3.55DEUDP
85.93.3.56DEUDP
85.93.3.57DEUDP
85.93.3.58DEUDP
85.93.3.59DEUDP
85.93.3.60DEUDP
85.93.3.61DEUDP
85.93.3.62DEUDP
85.93.3.63DEUDP
85.93.3.64DEUDP
85.93.3.65DEUDP
85.93.3.66DEUDP
85.93.3.67DEUDP
85.93.3.68DEUDP
85.93.3.69DEUDP
85.93.3.70DEUDP
85.93.3.71DEUDP
85.93.3.72DEUDP
85.93.3.73DEUDP
85.93.3.74DEUDP
85.93.3.75DEUDP
85.93.3.76DEUDP
85.93.3.77DEUDP
85.93.3.78DEUDP
85.93.3.79DEUDP
85.93.3.80DEUDP
85.93.3.81DEUDP
85.93.3.82DEUDP
85.93.3.83DEUDP
85.93.3.84DEUDP
85.93.3.85DEUDP
85.93.3.86DEUDP
85.93.3.87DEUDP
85.93.3.88DEUDP
85.93.3.89DEUDP
85.93.3.90DEUDP
85.93.3.91DEUDP
85.93.3.92DEUDP
85.93.3.93DEUDP
85.93.3.94DEUDP
85.93.3.95DEUDP
85.93.3.96DEUDP
85.93.3.97DEUDP
85.93.3.98DEUDP
85.93.3.99DEUDP
85.93.3.100DEUDP
85.93.3.101DEUDP
85.93.3.102DEUDP
85.93.3.103DEUDP
85.93.3.104DEUDP
85.93.3.105DEUDP
85.93.3.106DEUDP
85.93.3.107DEUDP
85.93.3.108DEUDP
85.93.3.109DEUDP
85.93.3.110DEUDP
85.93.3.111DEUDP
85.93.3.112DEUDP
85.93.3.113DEUDP
85.93.3.114DEUDP
85.93.3.115DEUDP
85.93.3.116DEUDP
85.93.3.117DEUDP
85.93.3.118DEUDP
85.93.3.119DEUDP
85.93.3.120DEUDP
85.93.3.121DEUDP
85.93.3.122DEUDP
85.93.3.123DEUDP
85.93.3.124DEUDP
85.93.3.125DEUDP
85.93.3.126DEUDP
85.93.3.127DEUDP
85.93.3.128DEUDP
85.93.3.129DEUDP
85.93.3.130DEUDP
85.93.3.131DEUDP
85.93.3.132DEUDP
85.93.3.133DEUDP
85.93.3.134DEUDP
85.93.3.135DEUDP
85.93.3.136DEUDP
85.93.3.137DEUDP
85.93.3.138DEUDP
85.93.3.139DEUDP
85.93.3.140DEUDP
85.93.3.141DEUDP
85.93.3.142DEUDP
85.93.3.143DEUDP
85.93.3.144DEUDP
85.93.3.145DEUDP
85.93.3.146DEUDP
85.93.3.147DEUDP
85.93.3.148DEUDP
85.93.3.149DEUDP
85.93.3.150DEUDP
85.93.3.151DEUDP
85.93.3.152DEUDP
85.93.3.153DEUDP
85.93.3.154DEUDP
85.93.3.155DEUDP
85.93.3.156DEUDP
85.93.3.157DEUDP
85.93.3.158DEUDP
85.93.3.159DEUDP
85.93.3.160DEUDP
85.93.3.161DEUDP
85.93.3.162DEUDP
85.93.3.163DEUDP
85.93.3.164DEUDP
85.93.3.165DEUDP
85.93.3.166DEUDP
85.93.3.167DEUDP
85.93.3.168DEUDP
85.93.3.169DEUDP
85.93.3.170DEUDP
85.93.3.171DEUDP
85.93.3.172DEUDP
85.93.3.173DEUDP
85.93.3.174DEUDP
85.93.3.175DEUDP
85.93.3.176DEUDP
85.93.3.177DEUDP
85.93.3.178DEUDP
85.93.3.179DEUDP
85.93.3.180DEUDP
85.93.3.181DEUDP
85.93.3.182DEUDP
85.93.3.183DEUDP
85.93.3.184DEUDP
85.93.3.185DEUDP
85.93.3.186DEUDP
85.93.3.187DEUDP
85.93.3.188DEUDP
85.93.3.189DEUDP
85.93.3.190DEUDP
85.93.3.191DEUDP
85.93.3.192DEUDP
85.93.3.193DEUDP
85.93.3.194DEUDP
85.93.3.195DEUDP
85.93.3.196DEUDP
85.93.3.197DEUDP
85.93.3.198DEUDP
85.93.3.199DEUDP
85.93.3.200DEUDP
85.93.3.201DEUDP
85.93.3.202DEUDP
85.93.3.203DEUDP
85.93.3.204DEUDP
85.93.3.205DEUDP
85.93.3.206DEUDP
85.93.3.207DEUDP
85.93.3.208DEUDP
85.93.3.209DEUDP
85.93.3.210DEUDP
85.93.3.211DEUDP
85.93.3.212DEUDP
85.93.3.213DEUDP
85.93.3.214DEUDP
85.93.3.215DEUDP
85.93.3.216DEUDP
85.93.3.217DEUDP
85.93.3.218DEUDP
85.93.3.219DEUDP
85.93.3.220DEUDP
85.93.3.221DEUDP
85.93.3.222DEUDP
thermostat60.maturebrokerage.com85.93.3.223DEUDP
benzine60.maturebrokerage.com85.93.3.224DEUDP
85.93.3.225DEUDP
85.93.3.226DEUDP
85.93.3.227DEUDP
85.93.3.228DEUDP
85.93.3.229DEUDP
conflux6.maturebrokerage.com85.93.3.230DEUDP
85.93.3.231DEUDP
Monitored Processes
Process Graph
Behavior Information - Sequential View
Process #1: d8891477315db13a640ed5956a636951.exe
(Host: 258, Network: 0)
+
InformationValue
ID / OS PID#1 / 0x6ec
OS Parent PID0x560 (c:\windows\explorer.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\Desktop
File Namec:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe
Command Line"C:\Users\hJrD1KOKY DS8lUjv\Desktop\d8891477315db13a640ed5956a636951.exe"
MonitorStart Time: 00:00:08, Reason: Analysis Target
UnmonitorEnd Time: 00:00:14, Reason: Terminated
Monitor Duration00:00:06
OS Thread IDs
#1
0x6DC
#2
0x6D0
#3
0x6C8
#4
0x5AC
#5
0x7E8
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00030fffPrivate MemoryReadable, WritableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000000500000x000500000x0008ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000900000x000900000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001900000x001900000x00193fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001a00000x001a00000x001b5fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000001c00000x001c00000x001fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002000000x002000000x0027ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002800000x002800000x0029cfffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
C_1251.NLS0x002a00000x002b0fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000002c00000x002c00000x002c0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002d00000x002d00000x002d0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000002d00000x002d00000x002d0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000002d00000x002d00000x002d0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002e00000x002e00000x003dffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003e00000x003e00000x003e0fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.1.db0x003f00000x003f3fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000003f00000x003f00000x003f6fffPagefile Backed MemoryReadableTrueFalseFalse
d8891477315db13a640ed5956a636951.exe0x004000000x0042afffMemory Mapped FileReadable, Writable, ExecutableTrueTrueFalse
locale.nls0x004300000x00496fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000004a00000x004a00000x004dffffPrivate MemoryReadable, WritableTrueFalseFalse
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000009.db0x004e00000x004f5fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000005000000x005000000x00501fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005100000x005100000x00510fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005200000x005200000x00521fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005300000x005300000x00531fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x005400000x00543fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000005500000x005500000x0058ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005900000x005900000x005cffffPrivate MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x005d00000x005d3fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000005f00000x005f00000x005fffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000006000000x006000000x00787fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007900000x007900000x00910fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000009200000x009200000x01d1ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001d200000x01d200000x01dfefffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001e000000x01e000000x01efffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f200000x01f200000x01f2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f300000x01f300000x0202ffffPrivate MemoryReadable, WritableTrueFalseFalse
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db0x020300000x0205ffffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000020600000x020600000x0209ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020a00000x020a00000x0219ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000021a00000x021a00000x021dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022000000x022000000x0223ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x022400000x0250efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000025100000x025100000x0260ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000026100000x026100000x02a02fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000002a100000x02a100000x02b0ffffPrivate MemoryReadable, WritableTrueFalseFalse
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db0x02b100000x02b75fffMemory Mapped FileReadableTrueFalseFalse
taskschd.dll0x745200000x7459cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samlib.dll0x745a00000x745b1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x745c00000x7475dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x747600000x74780fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x747900000x74884fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x748900000x7489afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x748a00000x748b2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x748c00000x748fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x749000000x74915fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samcli.dll0x749200000x7492efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x749300000x7493efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x749400000x74958fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x749600000x74968fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netapi32.dll0x749700000x74980fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mpr.dll0x749900000x749a1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x749b00000x749b8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winspool.drv0x749c00000x74a10fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x74a200000x74a9ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x74aa00000x74adbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x74ae00000x74ae7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x74af00000x74b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x74b500000x74b8efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x74c900000x74c9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x74ca00000x74cfffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x74d000000x74d5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x74d900000x74eebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x74f500000x74f55fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x74f600000x7500bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x750100000x75104fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x751100000x75192fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x751a00000x751f6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x752000000x7528ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x752900000x7538ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x753900000x753d5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x754700000x7550cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x755100000x75519fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x755200000x75655fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x756600000x75671fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x756800000x7581cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x758200000x7592ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x759300000x759cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x759e00000x759ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x759f00000x75a7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imagehlp.dll0x75a800000x75aa9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x75ab00000x766f9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x767000000x768fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x769000000x769effffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x769f00000x76a24fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x76a300000x76a48fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x76a500000x76a76fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76a800000x76b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x76b500000x76c6cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x76c700000x76cb4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x0000000076d400000x76d400000x76e5efffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x0000000076e600000x76e600000x76f59fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x771400000x772bffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efaa0000x7efaa0000x7efacfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Threads
Thread 0x6dc
(Host: 257, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualProtect, address = 0x7583435fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\user32.dll, base_address = 0x75290000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IMPGetIMEA, address = 0x75307331True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetForegroundWindow, address = 0x752cf170True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = ShowWindow, address = 0x752b0dfbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSysColor, address = 0x752a6c3cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetKeyboardLayoutNameA, address = 0x75306bd9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IsWindow, address = 0x752a7136True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSystemMetrics, address = 0x752a7d2fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetWindowPos, address = 0x752a8e4eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetFocus, address = 0x752b0deeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetMenuInfo, address = 0x752fd222True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = DispatchMessageA, address = 0x752a7bbbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = InvalidateRect, address = 0x752b1381True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\mswsock.dll, base_address = 0x74aa0000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSPStartup, address = 0x74aa8a9bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = dn_expand, address = 0x74abb97cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = sethostname, address = 0x74ab6582True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = MigrateWinsockConfiguration, address = 0x74aacd27True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = NPLoadNameSpaces, address = 0x74ac1a3eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetNameByTypeA, address = 0x74abe59fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = TransmitFile, address = 0x74abc7e2True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = inet_network, address = 0x74ab6597True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAddressByNameA, address = 0x74abddb5True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAcceptExSockaddrs, address = 0x74abc9daTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameW, address = 0x74abdfd7True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSARecvEx, address = 0x74ac1b55True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetServiceW, address = 0x74abf340True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceA, address = 0x74abefaeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsW, address = 0x74abcc25True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameA, address = 0x74abe260True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceW, address = 0x74abf118True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StartWsdpService, address = 0x74ab633dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsA, address = 0x74abd368True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = rexec, address = 0x74ab656dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StopWsdpService, address = 0x74ab5e56True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address = 0x75831450True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = InterlockedDecrement, address = 0x758313f0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapCreate, address = 0x75834a2dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetThreadLocale, address = 0x758335cfTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address = 0x75831725True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenW, address = 0x75831700True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FileTimeToSystemTime, address = 0x7583542cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address = 0x7585772fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address = 0x758387c9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount, address = 0x7583110cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address = 0x75831946True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleAliasesA, address = 0x758d6680True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenA, address = 0x75835a4bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiA, address = 0x75833e8eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address = 0x7584d802True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsA, address = 0x7583e349True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address = 0x758351cbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address = 0x77181f6eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetFileAttributesW, address = 0x75831b18True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address = 0x75835189True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address = 0x75831809True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringA, address = 0x7585bc39True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address = 0x7585d1a1True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address = 0x758334b0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address = 0x758351e3True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address = 0x75833509True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualAlloc, address = 0x75831856True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address = 0x758311f8True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address = 0x7583170dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address = 0x758317b9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetHandleCount, address = 0x7583cb29True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeA, address = 0x75858266True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiW, address = 0x7584d5cdTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStrings, address = 0x7583e361True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTime, address = 0x75835a96True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address = 0x758b454fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GlobalSize, address = 0x7584d16fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\gdi32.dll, base_address = 0x75200000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICW, address = 0x7521c040True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICA, address = 0x75217c2eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = GetCharWidth32W, address = 0x7521c93cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = DeleteObject, address = 0x75215689True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreatePen, address = 0x7521ba4fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateRectRgnIndirect, address = 0x7521a764True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateDCA, address = 0x75217bccTrue1
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False10
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODLOADmodule_name = CRYPT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WININET.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHLWAPI.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = VERSION.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = MPR.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = imagehlp.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WS2_32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = KERNEL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ADVAPI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = USER32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ole32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHELL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ntdll.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = OLEAUT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = GDI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = NETAPI32.dll, base_address = 0x0True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_02False1
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, base_address = 0x400000True1
Fn
MODGET_FILENAMEmodule_name = NETAPI32.dll, file_name = C:\Users\hJrD1KOKY DS8lUjv\Desktop\d8891477315db13a640ed5956a636951.exeTrue1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86)True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86), data_ident_out = 67True1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDirTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir, data_ident_out = 67True1
Fn
FILECREATEfile_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, process_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x2c0000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, base_address = 0x2c0000True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00False1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGWRITE_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01True1
Fn
Data
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGWRITE_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00True1
Fn
Data
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00, data_ident_out = 154True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01, data_ident_out = 103True1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITETrue1
Fn
USERLOOKUP_PRIVILEGEserver_name = Localhost, privilege = SeDebugPrivilegeTrue1
Fn
USERSET_PRIVILEGEserver_name = Localhost, process_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeDebugPrivilegeTrue1
Fn
MUTEXOPENmutex_name = shell.{0835FA03-68AC-09B6-0CE4-703246A746AB}, desired_access = SYNCHRONIZEFalse1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, READ_CONTROL, desired_access = PROCESS_VM_OPERATION, READ_CONTROLTrue1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1463843789-3877896393-3178144628-1000True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1463843789-3877896393-3178144628-1000, value_name = ProfileImagePath, data_ident_out = 67True1
Fn
COMCREATEclass_name = ShellLink, interface = IShellLinkW, cls_context = CLSCTX_INPROC_SERVERTrue1
Fn
COMQUERYclass_name = ShellLink, interface = IShellLinkW, new_interface = IPersistFile, True1
Fn
COMMETHODclass_name = ShellLink, interface = IPersistFile, method = LoadFalse1
Fn
COMCREATEclass_name = ShellLink, interface = IShellLinkW, cls_context = CLSCTX_INPROC_SERVERTrue1
Fn
COMMETHODclass_name = ShellLink, interface = IShellLinkW, method = SetPathTrue1
Fn
COMMETHODclass_name = ShellLink, interface = IShellLinkW, method = SetWorkingDirectoryTrue1
Fn
COMMETHODclass_name = ShellLink, interface = IShellLinkW, method = SetDescriptionTrue1
Fn
COMQUERYclass_name = ShellLink, interface = IShellLinkW, new_interface = IPersistFile, True1
Fn
COMMETHODclass_name = ShellLink, interface = IPersistFile, method = SaveTrue1
Fn
FILECREATE_SHORTCUTfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\esentutl.lnk, file_target = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunTrue1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Run, value_name = esentutl, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnceTrue1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnceTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = esentutl, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = RunFalse1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = Run, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command ProcessorTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command Processor, value_name = AutoRunFalse1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command ProcessorTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command Processor, value_name = AutoRun, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\DesktopTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\Desktop, value_name = SCRNSAVE.EXEFalse1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\DesktopTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\Desktop, value_name = SCRNSAVE.EXE, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
FILECREATE_DIRfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}True1
Fn
FILECOPYdestination_file_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, source_file_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, fail_if_exists = 0True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_FILENAMEmodule_name = c:\windows\syswow64\kernel32.dll, file_name = C:\Windows\syswow64\kernel32.dllTrue1
Fn
FILECREATEfile_name = c:\windows\syswow64\kernel32.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING, file_attributes = FILE_FLAG_BACKUP_SEMANTICSTrue1
Fn
FILECREATEfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, desired_access = FILE_WRITE_ATTRIBUTES, create_disposition = OPEN_EXISTING, file_attributes = FILE_FLAG_BACKUP_SEMANTICSTrue1
Fn
FILECREATEfile_name = c:\windows\syswow64\kernel32.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING, file_attributes = FILE_FLAG_BACKUP_SEMANTICSTrue1
Fn
FILECREATEfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}, desired_access = FILE_WRITE_ATTRIBUTES, create_disposition = OPEN_EXISTING, file_attributes = FILE_FLAG_BACKUP_SEMANTICSTrue1
Fn
PROCCREATEprocess_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe, os_tid = 0x6a0, os_pid = 0x7b8, creation_flags = CREATE_BREAKAWAY_FROM_JOB, show_window = SW_HIDETrue1
Fn
USERENUMERATEusers = Administrator, Guest, hJrD1KOKY DS8lUjv, server_name = Localhost, filter = FILTER_NORMAL_ACCOUNTTrue1
Fn
USERGET_INFOuser_name = Administrator, server_name = LocalhostTrue1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1463843789-3877896393-3178144628-500False1
Fn
USERGET_INFOuser_name = Guest, server_name = LocalhostTrue1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1463843789-3877896393-3178144628-501False1
Fn
USERGET_INFOuser_name = hJrD1KOKY DS8lUjv, server_name = LocalhostTrue1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1463843789-3877896393-3178144628-1000True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1463843789-3877896393-3178144628-1000, value_name = ProfileImagePath, data_ident_out = 67True1
Fn
COMCREATEclass_name = ShellLink, interface = IShellLinkW, cls_context = CLSCTX_INPROC_SERVERTrue1
Fn
COMQUERYclass_name = ShellLink, interface = IShellLinkW, new_interface = IPersistFile, True1
Fn
COMMETHODclass_name = ShellLink, interface = IPersistFile, method = LoadTrue1
Fn
COMMETHODclass_name = ShellLink, interface = IShellLinkW, method = GetPathTrue1
Fn
COMCREATEclass_name = ShellLink, interface = IShellLinkW, cls_context = CLSCTX_INPROC_SERVERTrue1
Fn
COMQUERYclass_name = ShellLink, interface = IShellLinkW, new_interface = IPersistFile, True1
Fn
COMMETHODclass_name = ShellLink, interface = IPersistFile, method = LoadFalse1
Fn
USERENUMERATEusers = Administrator, Guest, hJrD1KOKY DS8lUjv, server_name = Localhost, filter = FILTER_NORMAL_ACCOUNTTrue1
Fn
USERGET_INFOuser_name = Administrator, server_name = LocalhostTrue1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-500\Software\Microsoft\Windows\CurrentVersion\RunFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-500\Software\Microsoft\Windows\CurrentVersion\RunOnceFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-500\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-500\Software\Microsoft\Command ProcessorFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-500\Control Panel\DesktopFalse1
Fn
USERGET_INFOuser_name = Guest, server_name = LocalhostTrue1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-501\Software\Microsoft\Windows\CurrentVersion\RunFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-501\Software\Microsoft\Windows\CurrentVersion\RunOnceFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-501\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-501\Software\Microsoft\Command ProcessorFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-501\Control Panel\DesktopFalse1
Fn
USERGET_INFOuser_name = hJrD1KOKY DS8lUjv, server_name = LocalhostTrue1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Run, value_name = esentutlTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Run, value_name = esentutl, data_ident_out = 34True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnceTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = esentutlTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = esentutl, data_ident_out = 34True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = RunTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = Run, data_ident_out = 34True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command ProcessorTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command Processor, value_name = AutoRunTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command Processor, value_name = AutoRun, data_ident_out = 34True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\DesktopTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\Desktop, value_name = SCRNSAVE.EXETrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\Desktop, value_name = SCRNSAVE.EXE, data_ident_out = 34True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunTrue1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnceFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\.DEFAULT\Software\Microsoft\Command ProcessorTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\.DEFAULT\Software\Microsoft\Command Processor, value_name = AutoRunFalse1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\.DEFAULT\Control Panel\DesktopTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\.DEFAULT\Control Panel\Desktop, value_name = SCRNSAVE.EXEFalse1
Fn
COMCREATEclass_name = TaskScheduler, interface = ITaskService, cls_context = CLSCTX_INPROC_SERVERTrue1
Fn
COMMETHODclass_name = TaskScheduler, interface = ITaskService, method = ConnectTrue1
Fn
COMMETHODclass_name = TaskScheduler, interface = ITaskService, new_interface = ITaskFolder, method = GetFolderTrue1
Fn
COMMETHODclass_name = TaskScheduler, interface = ITaskFolder, method = DeleteTaskFalse1
Fn
PROCCREATEprocess_name = C:\Windows\system32\cmd.exe, os_tid = 0x65c, os_pid = 0x744, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDETrue1
Fn
SYSSLEEPduration = -1 (infinite)True1
Fn
PROCTERMINATEprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ecFalse1
Fn
Thread 0x6c8
(Host: 1, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
WNDCREATEclass_name = HV#pz[VRUySm[k]kYebgt1}U mRQCyI&3WXos3wXqI~t_%y~12N}aMq>b=A<+<V6)BG5r5s))U[<Dx&%PS^i$cz(lV=#KM}w(^V)}Jd27A~ILxSH2>me3!0)-sWogD@Dg=25@P7scdFojbEh2oS1Y_wWvhG[l=la{0FWfpF8vBXBJkIr]6NvtV#-kq%2j<*T2sRkz[sM+fMBPJ{yE%%ouz(q}G*ie$)E$EKpc+MkxU6!<eoEd* BRCvtndF9SC*, x_coordinate = 1, y_coordinate = 1, width = 1, height = 1, window_parameter = 0True1
Fn
Process #2: esentutl.exe
(Host: 208, Network: 1007)
+
InformationValue
ID / OS PID#2 / 0x7b8
OS Parent PID0x6ec (c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\Desktop
File Namec:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe
Command Line"C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"
MonitorStart Time: 00:00:13, Reason: Child Process
UnmonitorEnd Time: 00:00:35, Reason: Terminated
Monitor Duration00:00:22
OS Thread IDs
#6
0x6A0
#7
0x448
#11
0x478
#12
0x4A4
#13
0x634
#15
0x314
#108
0x880
#114
0x8B0
#116
0x8CC
#118
0x8E8
#119
0x8EC
#120
0x8F0
#121
0x8F8
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00030fffPrivate MemoryReadable, WritableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000000500000x000500000x0008ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000900000x000900000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001900000x001900000x00193fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x001a00000x00206fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000002100000x002100000x00225fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000002300000x002300000x0026ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002700000x002700000x002affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002b00000x002b00000x002ccfffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000002d00000x002d00000x0034ffffPrivate MemoryReadable, WritableTrueFalseFalse
C_1251.NLS0x003500000x00360fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000003700000x003700000x003affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003b00000x003b00000x003b0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003c00000x003c00000x003c6fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000003d00000x003d00000x003d1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000003e00000x003e00000x003effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003f00000x003f00000x003f1fffPagefile Backed MemoryReadableTrueFalseFalse
esentutl.exe0x004000000x0042afffMemory Mapped FileReadable, Writable, ExecutableTrueTrueFalse
pagefile_0x00000000004300000x004300000x0050efffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005100000x005100000x0054ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005100000x005100000x00511fffPagefile Backed MemoryReadableTrueFalseFalse
index.dat0x005200000x0052bfffMemory Mapped FileReadable, WritableTrueTrueFalse
index.dat0x005300000x00533fffMemory Mapped FileReadable, WritableTrueTrueFalse
index.dat0x005400000x00547fffMemory Mapped FileReadable, WritableTrueTrueFalse
pagefile_0x00000000005500000x005500000x00550fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005500000x005500000x00550fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005600000x005600000x0065ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000006600000x006600000x007e7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007f00000x007f00000x007f1fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000008000000x008000000x0080ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000008100000x008100000x00990fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000009a00000x009a00000x01d9ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001da00000x01da00000x01e9ffffPrivate MemoryReadable, WritableTrueFalseFalse
kernel32.dll.mui0x01ea00000x01f5ffffMemory Mapped FileReadable, WritableFalseFalseFalse
pagefile_0x0000000001f600000x01f600000x01f60fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x01f700000x01f73fffMemory Mapped FileReadableTrueFalseFalse
private_0x0000000001f800000x01f800000x01fbffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001fc00000x01fc00000x020bffffPrivate MemoryReadable, WritableTrueFalseFalse
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000009.db0x020c00000x020d5fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000020e00000x020e00000x020e0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x020f00000x020f3fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000021000000x021000000x0213ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x021400000x0240efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000024100000x024100000x0250ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025100000x025100000x0260ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025100000x025100000x0254ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025500000x025500000x0258ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025600000x025600000x0256ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025b00000x025b00000x025bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025d00000x025d00000x025dffffPrivate MemoryReadable, WritableTrueFalseFalse
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db0x026100000x0263ffffMemory Mapped FileReadableTrueFalseFalse
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db0x026400000x026a5fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000026b00000x026b00000x02aa2fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000002ab00000x02ab00000x02ab0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x0000000002ac00000x02ac00000x02afffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002b000000x02b000000x02bfffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002c000000x02c000000x02c3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002c400000x02c400000x02d3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002d400000x02d400000x02e3ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000002e400000x02e400000x02e40fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x02e500000x02e53fffMemory Mapped FileReadableTrueFalseFalse
oleaccrc.dll0x02e600000x02e60fffMemory Mapped FileReadableFalseFalseFalse
private_0x0000000002e600000x02e600000x02f5ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000002e700000x02e700000x02e71fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000002f600000x02f600000x02f9ffffPrivate MemoryReadable, WritableTrueFalseFalse
index.dat0x02fa00000x02fdffffMemory Mapped FileReadable, WritableTrueTrueFalse
private_0x0000000002fe00000x02fe00000x0301ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000030200000x030200000x0311ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031200000x031200000x0321ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000032200000x032200000x0325ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000032f00000x032f00000x0332ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000033300000x033300000x03672fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000036800000x036800000x0377ffffPrivate MemoryReadable, WritableTrueFalseFalse
ieframe.dll0x739d00000x7444ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc6.dll0x742e00000x742ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc.dll0x742f00000x74301fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
npmproxy.dll0x743100000x74317fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x743200000x7432dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x743300000x7436afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x743700000x74385fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netprofm.dll0x743900000x743e9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FWPUCLNT.DLL0x743f00000x74427fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wship6.dll0x744300000x74435fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WSHTCPIP.DLL0x744400000x74444fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x744500000x7445afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x744600000x74480fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x744900000x7462dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x746300000x74724fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winrnr.dll0x747300000x74737fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pnrpnsp.dll0x747400000x74751fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
NapiNSP.dll0x747600000x7476ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rasadhlp.dll0x747700000x74775fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nlaapi.dll0x747800000x7478ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
SensApi.dll0x747900000x74795fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x747a00000x747b2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rtutils.dll0x747c00000x747ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rasman.dll0x747d00000x747e4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rasapi32.dll0x747f00000x74841fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x748500000x74856fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x748600000x7487bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsapi.dll0x748800000x748c3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleacc.dll0x748900000x748cbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apphelp.dll0x748d00000x7491bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samcli.dll0x749200000x7492efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x749300000x7493efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x749400000x74958fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x749600000x74968fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netapi32.dll0x749700000x74980fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mpr.dll0x749900000x749a1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x749b00000x749b8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winspool.drv0x749c00000x74a10fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x74a200000x74a9ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x74aa00000x74adbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x74ae00000x74ae7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x74af00000x74b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x74b500000x74b8efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x74c900000x74c9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x74ca00000x74cfffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x74d000000x74d5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x74d900000x74eebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x74f500000x74f55fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x74f600000x7500bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x750100000x75104fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x751100000x75192fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x751a00000x751f6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x752000000x7528ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x752900000x7538ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x753900000x753d5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x754700000x7550cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x755100000x75519fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x755200000x75655fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x756600000x75671fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x756800000x7581cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x758200000x7592ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x759300000x759cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x759e00000x759ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x759f00000x75a7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imagehlp.dll0x75a800000x75aa9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x75ab00000x766f9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x767000000x768fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x769000000x769effffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x769f00000x76a24fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x76a300000x76a48fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x76a500000x76a76fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76a800000x76b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x76b500000x76c6cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x76c700000x76cb4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x0000000076d400000x76d400000x76e5efffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x0000000076e600000x76e600000x76f59fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
psapi.dll0x771100000x77114fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x771400000x772bffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007ef9e0000x7ef9e0000x7efa0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efa10000x7efa10000x7efa3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efa40000x7efa40000x7efa6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efa70000x7efa70000x7efa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efaa0000x7efaa0000x7efacfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Threads
Thread 0x6a0
(Host: 207, Network: 1007)
+
CategoryOperationInformationSuccessCountLogfile
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualProtect, address = 0x7583435fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\user32.dll, base_address = 0x75290000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IMPGetIMEA, address = 0x75307331True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetForegroundWindow, address = 0x752cf170True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = ShowWindow, address = 0x752b0dfbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSysColor, address = 0x752a6c3cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetKeyboardLayoutNameA, address = 0x75306bd9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IsWindow, address = 0x752a7136True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSystemMetrics, address = 0x752a7d2fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetWindowPos, address = 0x752a8e4eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetFocus, address = 0x752b0deeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetMenuInfo, address = 0x752fd222True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = DispatchMessageA, address = 0x752a7bbbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = InvalidateRect, address = 0x752b1381True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\mswsock.dll, base_address = 0x74aa0000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSPStartup, address = 0x74aa8a9bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = dn_expand, address = 0x74abb97cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = sethostname, address = 0x74ab6582True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = MigrateWinsockConfiguration, address = 0x74aacd27True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = NPLoadNameSpaces, address = 0x74ac1a3eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetNameByTypeA, address = 0x74abe59fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = TransmitFile, address = 0x74abc7e2True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = inet_network, address = 0x74ab6597True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAddressByNameA, address = 0x74abddb5True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAcceptExSockaddrs, address = 0x74abc9daTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameW, address = 0x74abdfd7True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSARecvEx, address = 0x74ac1b55True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetServiceW, address = 0x74abf340True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceA, address = 0x74abefaeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsW, address = 0x74abcc25True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameA, address = 0x74abe260True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceW, address = 0x74abf118True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StartWsdpService, address = 0x74ab633dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsA, address = 0x74abd368True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = rexec, address = 0x74ab656dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StopWsdpService, address = 0x74ab5e56True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address = 0x75831450True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = InterlockedDecrement, address = 0x758313f0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapCreate, address = 0x75834a2dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetThreadLocale, address = 0x758335cfTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address = 0x75831725True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenW, address = 0x75831700True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FileTimeToSystemTime, address = 0x7583542cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address = 0x7585772fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address = 0x758387c9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount, address = 0x7583110cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address = 0x75831946True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleAliasesA, address = 0x758d6680True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenA, address = 0x75835a4bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiA, address = 0x75833e8eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address = 0x7584d802True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsA, address = 0x7583e349True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address = 0x758351cbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address = 0x77181f6eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetFileAttributesW, address = 0x75831b18True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address = 0x75835189True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address = 0x75831809True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringA, address = 0x7585bc39True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address = 0x7585d1a1True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address = 0x758334b0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address = 0x758351e3True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address = 0x75833509True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualAlloc, address = 0x75831856True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address = 0x758311f8True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address = 0x7583170dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address = 0x758317b9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetHandleCount, address = 0x7583cb29True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeA, address = 0x75858266True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiW, address = 0x7584d5cdTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStrings, address = 0x7583e361True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTime, address = 0x75835a96True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address = 0x758b454fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GlobalSize, address = 0x7584d16fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\gdi32.dll, base_address = 0x75200000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICW, address = 0x7521c040True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICA, address = 0x75217c2eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = GetCharWidth32W, address = 0x7521c93cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = DeleteObject, address = 0x75215689True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreatePen, address = 0x7521ba4fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateRectRgnIndirect, address = 0x7521a764True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateDCA, address = 0x75217bccTrue1
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False10
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODLOADmodule_name = CRYPT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WININET.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHLWAPI.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = VERSION.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = MPR.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = imagehlp.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WS2_32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = KERNEL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ADVAPI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = USER32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ole32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHELL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ntdll.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = OLEAUT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = GDI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = NETAPI32.dll, base_address = 0x0True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_02False1
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True1
Fn
MODGET_FILENAMEmodule_name = NETAPI32.dll, file_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86)True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86), data_ident_out = 67True1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDirTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir, data_ident_out = 67True1
Fn
FILECREATEfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x7b8, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x370000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x7b8, base_address = 0x370000True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00, data_ident_out = 154True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01, data_ident_out = 103True1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITETrue1
Fn
USERLOOKUP_PRIVILEGEserver_name = Localhost, privilege = SeDebugPrivilegeTrue1
Fn
USERSET_PRIVILEGEserver_name = Localhost, process_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeDebugPrivilegeTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
PROCSET_CURDIRprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x7b8, new_path_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address = 0x7583195eTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address = 0x7584d650True1
Fn
PROCCREATEprocess_name = C:\Windows\system32\vssadmin.exe, operation = runas, show_window = SW_HIDETrue1
Fn
PROCCREATEprocess_name = C:\Windows\system32\wbem\wmic.exe, operation = runas, show_window = SW_HIDETrue1
Fn
PROCCREATEprocess_name = bcdedit.exe, operation = runas, show_window = SW_HIDETrue2
Fn
KEYBOARDGET_INFOtype = KB_LOCALE_IDTrue2
Fn
INETOPEN_CONNECTIONTrue1
Fn
INETOPEN_SESSIONTrue1
Fn
INETOPEN_HTTP_REQUESTTrue1
Fn
INETSEND_HTTP_REQUESTTrue1
Fn
INETREADTrue2
Fn
Data
MUTEXCREATEmutex_name = shell.{0835FA03-68AC-09B6-0CE4-703246A746AB}, initial_owner = 0True1
Fn
PROCOPENprocess_name = c:\windows\system32\conhost.exe, os_pid = 0x7b8, desired_access = PROCESS_ALL_ACCESSFalse1
Fn
PROCOPENprocess_name = c:\windows\system32\conhost.exe, os_pid = 0x7b8, desired_access = PROCESS_ALL_ACCESSTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, READ_CONTROL, desired_access = PROCESS_VM_OPERATION, READ_CONTROLTrue1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1463843789-3877896393-3178144628-1000True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1463843789-3877896393-3178144628-1000, value_name = ProfileImagePath, data_ident_out = 67True1
Fn
COMCREATEclass_name = ShellLink, interface = IShellLinkW, cls_context = CLSCTX_INPROC_SERVERTrue1
Fn
COMQUERYclass_name = ShellLink, interface = IShellLinkW, new_interface = IPersistFile, True1
Fn
COMMETHODclass_name = ShellLink, interface = IPersistFile, method = LoadTrue1
Fn
COMMETHODclass_name = ShellLink, interface = IShellLinkW, method = GetPathTrue1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Run, value_name = esentutlTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Run, value_name = esentutl, data_ident_out = 34True1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Run, value_name = esentutl, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnceTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = esentutlTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = esentutl, data_ident_out = 34True1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnceTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = esentutl, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = RunTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = Run, data_ident_out = 34True1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = Run, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command ProcessorTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command Processor, value_name = AutoRunTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command Processor, value_name = AutoRun, data_ident_out = 34True1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command ProcessorTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Software\Microsoft\Command Processor, value_name = AutoRun, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGOPEN_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\DesktopTrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\Desktop, value_name = SCRNSAVE.EXETrue1
Fn
REGREAD_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\Desktop, value_name = SCRNSAVE.EXE, data_ident_out = 34True1
Fn
REGCREATE_KEYreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\DesktopTrue1
Fn
REGWRITE_VALUEreg_name = HKEY_USERS\S-1-5-21-1463843789-3877896393-3178144628-1000\Control Panel\Desktop, value_name = SCRNSAVE.EXE, data = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Installed, data_ident_out = 0False1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Installed, data_ident_out = 0False1
Fn
FILECREATEfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x7b8, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x25e0000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x7b8, base_address = 0x25e0000True1
Fn
SCKCREATEaddress_family = AF_INET, type = SOCK_DGRAM, protocol = IPPROTO_UDPTrue1
Fn
SCKSENDremote_address = 85.93.0.0, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.1, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.2, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.3, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.4, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.5, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.6, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.7, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.8, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.9, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.10, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.11, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.12, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.13, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.14, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.15, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.16, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.17, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.18, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.19, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.20, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.21, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.22, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.23, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.24, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.25, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.26, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.27, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.28, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.29, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.30, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.31, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.32, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.33, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.34, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.35, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.36, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.37, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.38, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.39, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.40, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.41, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.42, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.43, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.44, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.45, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.46, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.47, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.48, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.49, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.50, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.51, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.52, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.53, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.54, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.55, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.56, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.57, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.58, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.59, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.60, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.61, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.62, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.63, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.64, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.65, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.66, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.67, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.68, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.69, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.70, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.71, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.72, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.73, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.74, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.75, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.76, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.77, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.78, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.79, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.80, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.81, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.82, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.83, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.84, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.85, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.86, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.87, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.88, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.89, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.90, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.91, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.92, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.93, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.94, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.95, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.96, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.97, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.98, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.99, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.100, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.101, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.102, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.103, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.104, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.105, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.106, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.107, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.108, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.109, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.110, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.111, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.112, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.113, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.114, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.115, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.116, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.117, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.118, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.119, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.120, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.121, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.122, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.123, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.124, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.125, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.126, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.127, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.128, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.129, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.130, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.131, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.132, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.133, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.134, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.135, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.136, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.137, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.138, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.139, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.140, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.141, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.142, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.143, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.144, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.145, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.146, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.147, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.148, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.149, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.150, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.151, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.152, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.153, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.154, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.155, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.156, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.157, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.158, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.159, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.160, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.161, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.162, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.163, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.164, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.165, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.166, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.167, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.168, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.169, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.170, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.171, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.172, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.173, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.174, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.175, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.176, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.177, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.178, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.179, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.180, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.181, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.182, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.183, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.184, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.185, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.186, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.187, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.188, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.189, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.190, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.191, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.192, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.193, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.194, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.195, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.196, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.197, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.198, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.199, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.200, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.201, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.202, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.203, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.204, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.205, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.206, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.207, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.208, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.209, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.210, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.211, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.212, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.213, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.214, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.215, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.216, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.217, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.218, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.219, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.220, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.221, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.222, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.223, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.224, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.225, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.226, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.227, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.228, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.229, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.230, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.231, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.232, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.233, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.234, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.235, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.236, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.237, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.238, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.239, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.240, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.241, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.242, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.243, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.244, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.245, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.246, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.247, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.248, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.249, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.250, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.251, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.252, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.253, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.254, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.0.255, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.0, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.1, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.2, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.3, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.4, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.5, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.6, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.7, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.8, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.9, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.10, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.11, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.12, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.13, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.14, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.15, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.16, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.17, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.18, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.19, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.20, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.21, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.22, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.23, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.24, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.25, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.26, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.27, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.28, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.29, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.30, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.31, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.32, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.33, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.34, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.35, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.36, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.37, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.38, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.39, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.40, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.41, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.42, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.43, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.44, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.45, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.46, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.47, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.48, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.49, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.50, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.51, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.52, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.53, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.54, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.55, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.56, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.57, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.58, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.59, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.60, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.61, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.62, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.63, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.64, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.65, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.66, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.67, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.68, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.69, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.70, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.71, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.72, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.73, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.74, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.75, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.76, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.77, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.78, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.79, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.80, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.81, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.82, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.83, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.84, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.85, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.86, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.87, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.88, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.89, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.90, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.91, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.92, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.93, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.94, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.95, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.96, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.97, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.98, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.99, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.100, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.101, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.102, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.103, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.104, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.105, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.106, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.107, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.108, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.109, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.110, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.111, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.112, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.113, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.114, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.115, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.116, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.117, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.118, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.119, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.120, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.121, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.122, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.123, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.124, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.125, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.126, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.127, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.128, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.129, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.130, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.131, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.132, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.133, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.134, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.135, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.136, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.137, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.138, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.139, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.140, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.141, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.142, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.143, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.144, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.145, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.146, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.147, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.148, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.149, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.150, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.151, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.152, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.153, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.154, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.155, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.156, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.157, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.158, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.159, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.160, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.161, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.162, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.163, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.164, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.165, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.166, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.167, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.168, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.169, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.170, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.171, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.172, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.173, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.174, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.175, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.176, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.177, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.178, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.179, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.180, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.181, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.182, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.183, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.184, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.185, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.186, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.187, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.188, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.189, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.190, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.191, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.192, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.193, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.194, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.195, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.196, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.197, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.198, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.199, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.200, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.201, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.202, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.203, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.204, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.205, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.206, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.207, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.208, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.209, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.210, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.211, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.212, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.213, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.214, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.215, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.216, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.217, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.218, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.219, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.220, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.221, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.222, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.223, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.224, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.225, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.226, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.227, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.228, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.229, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.230, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.231, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.232, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.233, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.234, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.235, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.236, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.237, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.238, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.239, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.240, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.241, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.242, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.243, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.244, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.245, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.246, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.247, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.248, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.249, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.250, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.251, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.252, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.253, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.254, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.1.255, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.0, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.1, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.2, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.3, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.4, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.5, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.6, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.7, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.8, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.9, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.10, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.11, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.12, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.13, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.14, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.15, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.16, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.17, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.18, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.19, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.20, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.21, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.22, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.23, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.24, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.25, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.26, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.27, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.28, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.29, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.30, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.31, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.32, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.33, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.34, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.35, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.36, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.37, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.38, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.39, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.40, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.41, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.42, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.43, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.44, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.45, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.46, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.47, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.48, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.49, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.50, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.51, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.52, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.53, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.54, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.55, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.56, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.57, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.58, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.59, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.60, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.61, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.62, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.63, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.64, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.65, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.66, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.67, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.68, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.69, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.70, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.71, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.72, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.73, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.74, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.75, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.76, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.77, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.78, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.79, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.80, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.81, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.82, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.83, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.84, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.85, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.86, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.87, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.88, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.89, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.90, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.91, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.92, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.93, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.94, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.95, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.96, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.97, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.98, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.99, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.100, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.101, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.102, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.103, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.104, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.105, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.106, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.107, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.108, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.109, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.110, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.111, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.112, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.113, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.114, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.115, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.116, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.117, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.118, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.119, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.120, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.121, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.122, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.123, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.124, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.125, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.126, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.127, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.128, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.129, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.130, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.131, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.132, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.133, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.134, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.135, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.136, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.137, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.138, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.139, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.140, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.141, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.142, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.143, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.144, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.145, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.146, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.147, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.148, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.149, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.150, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.151, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.152, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.153, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.154, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.155, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.156, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.157, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.158, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.159, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.160, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.161, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.162, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.163, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.164, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.165, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.166, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.167, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.168, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.169, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.170, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.171, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.172, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.173, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.174, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.175, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.176, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.177, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.178, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.179, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.180, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.181, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.182, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.183, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.184, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.185, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.186, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.187, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.188, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.189, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.190, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.191, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.192, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.193, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.194, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.195, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.196, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.197, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.198, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.199, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.200, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.201, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.202, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.203, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.204, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.205, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.206, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.207, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.208, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.209, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.210, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.211, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.212, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.213, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.214, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.215, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.216, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.217, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.218, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.219, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.220, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.221, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.222, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.223, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.224, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.225, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.226, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.227, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.228, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.229, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.230, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.231, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.232, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.233, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.234, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.235, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.236, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.237, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.238, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.239, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.240, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.241, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.242, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.243, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.244, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.245, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.246, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.247, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.248, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.249, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.250, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.251, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.252, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.253, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.254, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.2.255, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.0, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.1, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.2, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.3, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.4, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.5, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.6, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.7, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.8, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.9, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.10, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.11, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.12, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.13, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.14, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.15, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.16, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.17, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.18, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.19, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.20, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.21, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.22, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.23, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.24, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.25, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.26, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.27, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.28, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.29, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.30, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.31, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.32, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.33, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.34, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.35, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.36, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.37, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.38, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.39, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.40, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.41, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.42, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
SCKSENDremote_address = 85.93.3.43, size = 9, flags = NO_FLAG_SET, remote_port = 6892, size_out = 9True1
Fn
Data
For performance reasons, the remaining 188 entries are omitted.
Click to download all 1188 entries as text file (0.81 MB).
Thread 0x478
(Host: 1, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
WNDCREATEclass_name = ia2%bd_*$!C(~ow(Be(^WcO-77 WO=3OU9QxCnL{TC+w0b^]a7G}Hou00N]5@M!1iZVh<4mCyn9*+Mx%Uu^B+q~zP=]eF8=xXdoCF+t{NHhbI7sj ]#UzjG3J8OUV8yV+r510#*}f88(oz&~g6@1[aRV[zu$Qbu3W6*2R8!LuZ1ILE8*dkm-TY1BCC52Q3c>Y}m1R9&b(mblCv<soKw^LCyf3F+L!Jt%8p{V3!eOP@fhW5Xo9)M$oXLv)2E}-52, x_coordinate = 1, y_coordinate = 1, width = 1, height = 1, window_parameter = 0True1
Fn
Process #3: cmd.exe
(Host: 55, Network: 0)
+
InformationValue
ID / OS PID#3 / 0x744
OS Parent PID0x6ec (c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\Desktop
File Namec:\windows\syswow64\cmd.exe
Command Line/d /c taskkill /t /f /im "d8891477315db13a640ed5956a636951.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\hJrD1KOKY DS8lUjv\Desktop\d8891477315db13a640ed5956a636951.exe" > NUL
MonitorStart Time: 00:00:13, Reason: Child Process
UnmonitorEnd Time: 00:00:19, Reason: Terminated
Monitor Duration00:00:06
OS Thread IDs
#8
0x65C
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x0002ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00036fffPagefile Backed MemoryReadableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000000500000x000500000x00053fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00060fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000700000x000700000x000effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000f00000x000f00000x000f1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001000000x001000000x0010ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001100000x001100000x00110fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001200000x001200000x00120fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001500000x001500000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001900000x001900000x0028ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x002900000x002f6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000003600000x003600000x0045ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004600000x004600000x005e7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005f00000x005f00000x00770fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007800000x007800000x01b7ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001b800000x01b800000x01ec2fffPagefile Backed MemoryReadableTrueFalseFalse
cmd.exe0x4aae00000x4ab2bfffMemory Mapped FileReadable, Writable, ExecutableTrueFalseFalse
winbrand.dll0x749100000x74916fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x74ae00000x74ae7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x74af00000x74b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x74b500000x74b8efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x74c900000x74c9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x74ca00000x74cfffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x74d000000x74d5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x74f600000x7500bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x752000000x7528ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x752900000x7538ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x753900000x753d5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x754700000x7550cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x755100000x75519fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x758200000x7592ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x759300000x759cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x769000000x769effffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x76a300000x76a48fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76a800000x76b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x0000000076d400000x76d400000x76e5efffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x0000000076e600000x76e600000x76f59fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x771400000x772bffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Threads
Thread 0x65c
(Host: 55, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
MODGET_HANDLEmodule_name = c:\windows\syswow64\cmd.exe, base_address = 0x4aae0000True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address = 0x7584a84fTrue1
Fn
REGOPEN_KEYreg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\SystemFalse1
Fn
FILEOPENfile_name = STD_OUTPUT_HANDLETrue3
Fn
FILEOPENfile_name = STD_INPUT_HANDLETrue2
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command ProcessorTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data_ident_out = 0False1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data_ident_out = 1True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data_ident_out = 1False1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data_ident_out = 0True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data_ident_out = 64True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data_ident_out = 64True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data_ident_out = 64False1
Fn
REGOPEN_KEYreg_name = HKEY_CURRENT_USER\Software\Microsoft\Command ProcessorTrue1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data_ident_out = 64False1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data_ident_out = 1True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data_ident_out = 1False1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data_ident_out = 0True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data_ident_out = 9True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data_ident_out = 9True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data_ident_out = "C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"True1
Fn
MODGET_FILENAMEfile_name = C:\Windows\SysWOW64\cmd.exeTrue1
Fn
PROCSET_CURDIRprocess_name = c:\windows\syswow64\cmd.exe, os_pid = 0x744, new_path_name = c:\users\hjrd1koky ds8lujv\desktopTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75820000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address = 0x75853b92True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address = 0x75834a5dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address = 0x7584a79dTrue1
Fn
FILEOPENfile_name = STD_OUTPUT_HANDLETrue4
Fn
FILECREATEfile_name = \device\null, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMALTrue1
Fn
FILEOPENfile_name = \device\nullTrue1
Fn
PROCCREATEprocess_name = C:\Windows\system32\taskkill.exe, os_tid = 0x490, os_pid = 0x484, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\Users\hJrD1KOKY DS8lUjv\Desktop, show_window = SW_SHOWNORMALTrue1
Fn
FILEOPENfile_name = \device\nullTrue3
Fn
FILEOPENfile_name = STD_OUTPUT_HANDLETrue1
Fn
FILECREATEfile_name = \device\null, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMALTrue1
Fn
FILEOPENfile_name = \device\nullTrue1
Fn
PROCCREATEprocess_name = C:\Windows\system32\PING.EXE, os_tid = 0x830, os_pid = 0x82c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\Users\hJrD1KOKY DS8lUjv\Desktop, show_window = SW_SHOWNORMALTrue1
Fn
FILEOPENfile_name = \device\nullTrue3
Fn
FILEOPENfile_name = STD_OUTPUT_HANDLETrue1
Fn
FILECREATEfile_name = \device\null, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMALTrue1
Fn
FILEOPENfile_name = \device\nullTrue1
Fn
FILEDELETEfile_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exeTrue1
Fn
FILEOPENfile_name = \device\nullTrue2
Fn
FILEOPENfile_name = STD_INPUT_HANDLETrue1
Fn
Process #4: taskkill.exe
+
InformationValue
ID / OS PID#4 / 0x484
OS Parent PID0x744 (c:\windows\syswow64\cmd.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\Desktop
File Namec:\windows\syswow64\taskkill.exe
Command Linetaskkill /t /f /im "d8891477315db13a640ed5956a636951.exe"
MonitorStart Time: 00:00:14, Reason: Child Process
UnmonitorEnd Time: 00:00:18, Reason: Terminated
Monitor Duration00:00:04
OS Thread IDs
#9
0x490
#10
0x474
#14
0x7BC
#16
0x7EC
#17
0x310
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x0002ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00036fffPagefile Backed MemoryReadableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000000500000x000500000x00053fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00060fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000700000x000700000x000affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000b00000x000b00000x000b1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
taskkill.exe.mui0x000c00000x000c3fffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000000d00000x000d00000x000d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000e00000x000e00000x000e0fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000f00000x000f00000x000f0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001000000x001000000x0017ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x001800000x001e6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000001f00000x001f00000x001f0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002100000x002100000x0024ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002500000x002500000x0028ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002a00000x002a00000x0039ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003a00000x003a00000x00527fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005500000x005500000x0055ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005600000x005600000x006e0fffPagefile Backed MemoryReadableTrueFalseFalse
KernelBase.dll.mui0x006f00000x007affffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000007b00000x007b00000x007effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008200000x008200000x0085ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008800000x008800000x008bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009000000x009000000x0093ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009600000x009600000x0099ffffPrivate MemoryReadable, WritableTrueFalseFalse
taskkill.exe0x00a400000x00a55fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x0000000000a600000x00a600000x01e5ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001e600000x01e600000x01f5ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f700000x01f700000x01faffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x01fb00000x0227efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000022800000x022800000x022bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022c00000x022c00000x022fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000023500000x023500000x0238ffffPrivate MemoryReadable, WritableTrueFalseFalse
wmiutils.dll0x742c00000x742d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdsapi.dll0x742e00000x742f7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
fastprox.dll0x743000000x74395fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemsvc.dll0x743a00000x743aefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x743b00000x743bdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x743c00000x743fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x744000000x74415fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x744200000x74448fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemcomn.dll0x747300000x7478bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemprox.dll0x747900000x74799fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dbghelp.dll0x747c00000x748aafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wtsapi32.dll0x748b00000x748bcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
framedynos.dll0x748c00000x748f4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x749000000x74907fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x749300000x7493efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x749400000x74958fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x749600000x74968fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netapi32.dll0x749700000x74980fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mpr.dll0x749900000x749a1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x749b00000x749b8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x74ae00000x74ae7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x74af00000x74b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x74b500000x74b8efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x74c900000x74c9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x74ca00000x74cfffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x74d000000x74d5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x74d900000x74eebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x74f500000x74f55fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x74f600000x7500bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x751100000x75192fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x751a00000x751f6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x752000000x7528ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x752900000x7538ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x753900000x753d5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x754700000x7550cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x755100000x75519fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x758200000x7592ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x759300000x759cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x759f00000x75a7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x769000000x769effffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x769f00000x76a24fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x76a300000x76a48fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76a800000x76b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x0000000076d400000x76d400000x76e5efffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x0000000076e600000x76e600000x76f59fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x771400000x772bffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efaa0000x7efaa0000x7efacfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Process #6: vssadmin.exe
+
InformationValue
ID / OS PID#6 / 0x698
OS Parent PID0x7b8 (c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}
File Namec:\windows\system32\vssadmin.exe
Command Line"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
MonitorStart Time: 00:00:17, Reason: Child Process
UnmonitorEnd Time: 00:00:24, Reason: Terminated
Monitor Duration00:00:07
OS Thread IDs
#61
0x57C
#62
0x454
#63
0x338
#64
0x6C4
#65
0x540
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x0002ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000c00000x000c00000x000c6fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000d00000x000d00000x000d1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
vssadmin.exe.mui0x000e00000x000ecfffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000000f00000x000f00000x000f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001000000x001000000x00100fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001100000x001100000x00110fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001200000x001200000x00120fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001b00000x001b00000x0022ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002300000x002300000x0032ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003700000x003700000x0037ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004100000x004100000x0050ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005100000x005100000x00697fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006a00000x006a00000x00820fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008300000x008300000x01c2ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001c800000x01c800000x01cfffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001dd00000x01dd00000x01e4ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x01e500000x0211efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000022500000x022500000x022cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000023000000x023000000x0237ffffPrivate MemoryReadable, WritableTrueFalseFalse
kernel32.dll0x76d400000x76e5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x76e600000x76f59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff20000x7fff20000x7fff2fffPrivate MemoryReadable, WritableTrueFalseFalse
vssadmin.exe0xff4000000xff42cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
vss_ps.dll0x7fef58000000x7fef5813fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
vsstrace.dll0x7fefa0b00000x7fefa0c6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
vssapi.dll0x7fefa0d00000x7fefa27ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
atl.dll0x7fefaa800000x7fefaa98fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefc4a00000x7fefc4e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefc7a00000x7fefc7b6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefcda00000x7fefcdaefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefce900000x7fefcea3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefd0d00000x7fefd13afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefd2900000x7fefd2aefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefd4300000x7fefd632fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefd8d00000x7fefd9aafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefe7400000x7fefe7a6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe7b00000x7fefe886fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefe8900000x7fefe89dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe8a00000x7fefe9ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe9d00000x7fefea68fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefea700000x7fefea9dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefeb200000x7fefebe8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefed400000x7fefeddefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7feff1600000x7feff268fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feff2800000x7feff280fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd40000x7fffffd40000x7fffffd5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd60000x7fffffd60000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #11: ping.exe
(Host: 11, Network: 2)
+
InformationValue
ID / OS PID#11 / 0x82c
OS Parent PID0x744 (c:\windows\syswow64\cmd.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\Desktop
File Namec:\windows\syswow64\ping.exe
Command Lineping -n 1 127.0.0.1
MonitorStart Time: 00:00:18, Reason: Child Process
UnmonitorEnd Time: 00:00:19, Reason: Terminated
Monitor Duration00:00:01
OS Thread IDs
#104
0x830
#105
0x838
#106
0x840
#107
0x844
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x0002ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00036fffPagefile Backed MemoryReadableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000000500000x000500000x00053fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00060fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000700000x000700000x00071fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
ping.exe.mui0x000800000x00082fffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000000900000x000900000x00090fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000a00000x000a00000x000a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000b00000x000b00000x000effffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x000f00000x00156fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001700000x001700000x001affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001d00000x001d00000x0020ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002300000x002300000x002affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003300000x003300000x0042ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004400000x004400000x0047ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004900000x004900000x004cffffPrivate MemoryReadable, WritableTrueFalseFalse
PING.EXE0x005100000x00517fffMemory Mapped FileReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000005200000x005200000x0055ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005700000x005700000x005affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005d00000x005d00000x0060ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000006500000x006500000x0065ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000006600000x006600000x007e7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007f00000x007f00000x00970fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000009800000x009800000x01d7ffffPagefile Backed MemoryReadableTrueFalseFalse
SortDefault.nls0x01d800000x0204efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000022200000x022200000x0225ffffPrivate MemoryReadable, WritableTrueFalseFalse
WSHTCPIP.DLL0x748d00000x748d4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x748e00000x748e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x748f00000x7490bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x74aa00000x74adbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x74ae00000x74ae7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x74af00000x74b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x74b500000x74b8efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x74c900000x74c9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x74ca00000x74cfffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x74d000000x74d5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x74f500000x74f55fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x74f600000x7500bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x752000000x7528ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x752900000x7538ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x753900000x753d5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x754700000x7550cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x755100000x75519fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x758200000x7592ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x759300000x759cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x769000000x769effffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x769f00000x76a24fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x76a300000x76a48fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76a800000x76b4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x0000000076d400000x76d400000x76e5efffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x0000000076e600000x76e600000x76f59fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x771400000x772bffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Threads
Thread 0x830
(Host: 11, Network: 2)
+
CategoryOperationInformationSuccessCountLogfile
MODGET_HANDLEmodule_name = c:\windows\syswow64\ping.exe, base_address = 0x510000True1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ParametersTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, value_name = DefaultTTL, data_ident_out = 0False1
Fn
DNSRESOLVE_NAMEhost = 127.0.0.1True1
Fn
FILEWRITEsize = 20True1
Fn
Data
FILEWRITEsize = 24True1
Fn
Data
ICMPSENDdestination_address = 127.0.0.1, source_address = 0.0.0.0, timeout = 4000True1
Fn
FILEWRITEsize = 22True1
Fn
Data
FILEWRITEsize = 9True3
Fn
Data
FILEWRITEsize = 92True1
Fn
Data
FILEWRITEsize = 97True1
Fn
Data
Process #12: wmic.exe
+
InformationValue
ID / OS PID#12 / 0x884
OS Parent PID0x7b8 (c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}
File Namec:\windows\system32\wbem\wmic.exe
Command Line"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
MonitorStart Time: 00:00:24, Reason: Child Process
UnmonitorEnd Time: 00:00:24, Reason: Terminated
Monitor Duration00:00:00
OS Thread IDs
#109
0x888
#110
0x89C
#111
0x8A0
#112
0x8A4
#113
0x8A8
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x0002ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000c00000x000c00000x000c6fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000d00000x000d00000x000d1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
WMIC.exe.mui0x000e00000x000effffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000000f00000x000f00000x000f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001000000x001000000x00100fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001100000x001100000x00110fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001200000x001200000x00120fffPagefile Backed MemoryReadableTrueFalseFalse
msxml3r.dll0x001300000x00130fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001400000x001400000x0015ffffPrivate Memory-TrueFalseFalse
pagefile_0x00000000001600000x001600000x00161fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001700000x001700000x00170fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001800000x001800000x00181fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001900000x001900000x0020ffffPrivate MemoryReadable, WritableTrueFalseFalse
index.dat0x002100000x0021bfffMemory Mapped FileReadable, WritableTrueFalseFalse
index.dat0x002200000x00223fffMemory Mapped FileReadable, WritableTrueFalseFalse
index.dat0x002300000x00237fffMemory Mapped FileReadable, WritableTrueFalseFalse
private_0x00000000002900000x002900000x0038ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003900000x003900000x0048ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004b00000x004b00000x0052ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005300000x005300000x0053ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005400000x005400000x006c7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006d00000x006d00000x00850fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008600000x008600000x01c5ffffPagefile Backed MemoryReadableTrueFalseFalse
KernelBase.dll.mui0x01c600000x01d1ffffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x0000000001d900000x01d900000x01e0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e300000x01e300000x01eaffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001ee00000x01ee00000x01f5ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x01f600000x0222efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000023000000x023000000x0237ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000024500000x024500000x024cffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000024d00000x024d00000x025aefffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000025d00000x025d00000x0264ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000026500000x026500000x02a4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002b200000x02b200000x02b9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002ba00000x02ba00000x02c1ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002c200000x02c200000x02c9ffffPrivate MemoryReadable, WritableTrueFalseFalse
kernel32.dll0x76d400000x76e5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x76e600000x76f59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fffb0000x7fffb0000x7fffbfffPrivate MemoryReadable, WritableTrueFalseFalse
WMIC.exe0xff8400000xff8ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msxml3.dll0x7fef49f00000x7fef4bc3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
framedynos.dll0x7fef53f00000x7fef543bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemsvc.dll0x7fef8f100000x7fef8f23fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemprox.dll0x7fef91800000x7fef918efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdsapi.dll0x7fef91900000x7fef91b6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
fastprox.dll0x7fef91c00000x7fef92a1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemcomn.dll0x7fef94300000x7fef94b5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x7fefa9600000x7fefa96afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x7fefa9700000x7fefa996fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x7fefae200000x7fefae4cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wtsapi32.dll0x7fefb2000000x7fefb210fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefb7d00000x7fefb825fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x7fefb9800000x7fefbb73fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefc4a00000x7fefc4e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsapi.dll0x7fefc5c00000x7fefc61afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefc7a00000x7fefc7b6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefcd400000x7fefcd4afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefcd700000x7fefcd94fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefcda00000x7fefcdaefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefce900000x7fefcea3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefceb00000x7fefcebefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefcf500000x7fefcf5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefcf600000x7fefd0c6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefd0d00000x7fefd13afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefd2800000x7fefd287fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefd2900000x7fefd2aefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x7fefd2b00000x7fefd427fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefd4300000x7fefd632fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefd6400000x7fefd68cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x7fefd6900000x7fefd6e1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefd8d00000x7fefd9aafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x7fefd9b00000x7fefe737fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefe7400000x7fefe7a6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe7b00000x7fefe886fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefe8900000x7fefe89dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe8a00000x7fefe9ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe9d00000x7fefea68fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefea700000x7fefea9dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefeaa00000x7fefeb10fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefeb200000x7fefebe8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x7fefec100000x7fefed39fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefed400000x7fefeddefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x7fefede00000x7feff038fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7feff1600000x7feff268fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feff2800000x7feff280fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #13: bcdedit.exe
+
InformationValue
ID / OS PID#13 / 0x8b4
OS Parent PID0x7b8 (c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}
File Namec:\windows\system32\bcdedit.exe
Command Line"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
MonitorStart Time: 00:00:24, Reason: Child Process
UnmonitorEnd Time: 00:00:24, Reason: Terminated
Monitor Duration00:00:00
OS Thread IDs
#115
0x8B8
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x0002ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000000d00000x000d00000x0014ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001700000x001700000x0026ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002700000x002700000x0036ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003b00000x003b00000x003bffffPrivate MemoryReadable, WritableTrueFalseFalse
kernel32.dll0x76d400000x76e5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fff0fffPrivate MemoryReadable, WritableTrueFalseFalse
bcdedit.exe0xfffd00000x100026fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefd0d00000x7fefd13afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefd2900000x7fefd2aefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefd8d00000x7fefd9aafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe8a00000x7fefe9ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefed400000x7fefeddefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feff2800000x7feff280fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #14: bcdedit.exe
+
InformationValue
ID / OS PID#14 / 0x8d0
OS Parent PID0x7b8 (c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}
File Namec:\windows\system32\bcdedit.exe
Command Line"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
MonitorStart Time: 00:00:24, Reason: Child Process
UnmonitorEnd Time: 00:00:24, Reason: Terminated
Monitor Duration00:00:00
OS Thread IDs
#117
0x8D4
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000700000x000700000x000effffPrivate MemoryReadable, WritableTrueFalseFalse
ntdll.dll0x76f600000x77108fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fffb0000x7fffb0000x7fffbfffPrivate MemoryReadable, WritableTrueFalseFalse
bcdedit.exe0xff4100000xff466fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feff2800000x7feff280fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #16: System
+
InformationValue
ID / OS PID#16 / 0x4
OS Parent PID0xffffffffffffffff (Unknown)
Initial Working Directory
File NameSystem
Command Line
MonitorStart Time: 00:00:42, Reason: Kernel Analysis
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:46
OS Thread IDs
#159
0x8
#160
0x14
#161
0x2C
#162
0x50
#163
0x5C
#164
0x6C
#165
0x44
#166
0x98
#167
0x9C
#168
0x40
#169
0x94
#170
0x3C
#171
0x64
#172
0xAC
#173
0x28
#174
0xB0
#175
0xC0
#176
0xB8
#177
0x24
#178
0x20
#179
0x30
#180
0x34
#181
0xBC
#182
0x78
#183
0xC4
#184
0xC8
#185
0xCC
#186
0xD0
#187
0xD4
#189
0xE0
#190
0x38
#192
0xE8
#194
0x48
#195
0xF8
#196
0x100
#197
0xA8
#198
0x80
#199
0x84
#200
0x104
#201
0x110
#202
0x114
#205
0x118
#206
0x4C
#207
0x108
#209
0x130
#210
0x134
#211
0x138
#212
0x13C
#229
0x190
#236
0x60
#240
0x68
#252
0xFC
#254
0x8C
#280
0x90
#282
0x74
#288
0x274
#315
0x2E8
#336
0x88
#366
0x3C0
#405
0x278
#454
0x47C
#470
0x4E8
#514
0x4F0
#519
0x4EC
#523
0x5D0
#525
0xB4
#551
0x644
#552
0x1C
#555
0x650
#570
0x690
#571
0x694
#602
0x714
#619
0x758
#623
0x768
#625
0x770
#627
0x778
#628
0x77C
#630
0x784
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
pagefile_0x00000000000100000x000100000x00032fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
Process #17: smss.exe
+
InformationValue
ID / OS PID#17 / 0xd8
OS Parent PID0x4 (System)
Initial Working DirectoryC:\Windows
File Namec:\windows\system32\smss.exe
Command Line\SystemRoot\System32\smss.exe
MonitorStart Time: 00:00:48, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:40
OS Thread IDs
#188
0xDC
#191
0xEC
#203
0x11C
#217
0x160
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x (null)0x000000000x000fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001000000x001000000x00101fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001f00000x001f00000x0026ffffPrivate MemoryReadable, WritableTrueFalseFalse
smss.exe0x476000000x4761ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
Process #18: autochk.exe
+
InformationValue
ID / OS PID#18 / 0xf0
OS Parent PID0xd8 (c:\windows\system32\smss.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\autochk.exe
Command Line\??\C:\Windows\system32\autochk.exe *
MonitorStart Time: 00:00:49, Reason: Child Process
UnmonitorEnd Time: 00:00:50, Reason: Terminated
Monitor Duration00:00:01
OS Thread IDs
#193
0xF4
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000500000x000500000x000cffffPrivate MemoryReadable, WritableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
autochk.exe0xffc700000xffd30fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #19: smss.exe
+
InformationValue
ID / OS PID#19 / 0x120
OS Parent PID0xd8 (c:\windows\system32\smss.exe)
Initial Working DirectoryC:\Windows
File Namec:\windows\system32\smss.exe
Command Line\SystemRoot\System32\smss.exe 00000000 0000003c
MonitorStart Time: 00:00:52, Reason: Child Process
UnmonitorEnd Time: 00:00:54, Reason: Terminated
Monitor Duration00:00:02
OS Thread IDs
#204
0x124
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000f00000x000f00000x0016ffffPrivate MemoryReadable, WritableTrueFalseFalse
smss.exe0x476000000x4761ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #20: csrss.exe
+
InformationValue
ID / OS PID#20 / 0x128
OS Parent PID0x120 (c:\windows\system32\smss.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\csrss.exe
Command Line%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
MonitorStart Time: 00:00:53, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:35
OS Thread IDs
#208
0x12C
#213
0x140
#214
0x144
#215
0x148
#216
0x14C
#220
0x16C
#230
0x194
#231
0x198
#237
0x1B4
#246
0x1D8
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x (null)0x000000000x000fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001000000x001000000x00100fffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x001000000x00166fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000001700000x001700000x00176fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001800000x001800000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001900000x001900000x0028ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002900000x002900000x00291fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000002a00000x002a00000x002a0fffPrivate MemoryReadable, WritableTrueFalseFalse
vgasys.fon0x002b00000x002b1fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000002c00000x002c00000x002c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002d00000x002d00000x0030ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002d00000x002d00000x002dffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
marlett.ttf0x002e00000x002e6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000002f00000x002f00000x00307fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003100000x003100000x0040ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004100000x004100000x00590fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005a00000x005a00000x00992fffPagefile Backed MemoryReadableTrueFalseFalse
segoeui.ttf0x009a00000x00a1efffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x0000000000a200000x00a200000x00a4ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000ae00000x00ae00000x00b1ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000b200000x00b200000x00b5ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000bf00000x00bf00000x00c2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c600000x00c600000x00c9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000cb00000x00cb00000x00ceffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000000cf00000x00cf00000x00e77fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000eb00000x00eb00000x00eeffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000f200000x00f200000x00f5ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000000f600000x00f600000x0235ffffPagefile Backed MemoryReadableTrueFalseFalse
csrss.exe0x498a00000x498a5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sxs.dll0x7fefd9500000x7fefd9e0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sxssrv.dll0x7fefda600000x7fefda6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsrv.dll0x7fefda700000x7fefdaa7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
basesrv.dll0x7fefdab00000x7fefdac0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
csrsrv.dll0x7fefdad00000x7fefdae2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdcfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #21: smss.exe
+
InformationValue
ID / OS PID#21 / 0x150
OS Parent PID0xd8 (c:\windows\system32\smss.exe)
Initial Working DirectoryC:\Windows
File Namec:\windows\system32\smss.exe
Command Line\SystemRoot\System32\smss.exe 00000001 0000003c
MonitorStart Time: 00:00:54, Reason: Child Process
UnmonitorEnd Time: 00:00:54, Reason: Terminated
Monitor Duration00:00:00
OS Thread IDs
#218
0x154
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002100000x002100000x0028ffffPrivate MemoryReadable, WritableTrueFalseFalse
smss.exe0x476000000x4761ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #22: wininit.exe
+
InformationValue
ID / OS PID#22 / 0x158
OS Parent PID0x120 (c:\windows\system32\smss.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\wininit.exe
Command Linewininit.exe
MonitorStart Time: 00:00:54, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:34
OS Thread IDs
#219
0x15C
#226
0x188
#227
0x18C
#233
0x1A0
#234
0x1A4
#235
0x1B0
#253
0x1F0
#301
0x2B4
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x0003ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00041fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000500000x000500000x00050fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000600000x000600000x00060fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000700000x000700000x0016ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001900000x001900000x0020ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x002100000x00276fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000002800000x002800000x0037ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003800000x003800000x00507fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005100000x005100000x00690fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006a00000x006a00000x00a92fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000aa00000x00aa00000x00acffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000b100000x00b100000x00b8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000bd00000x00bd00000x00c4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c600000x00c600000x00cdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d400000x00d400000x00dbffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000e400000x00e400000x00ebffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000f300000x00f300000x00faffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000010900000x010900000x0110ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000011100000x011100000x0250ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000025200000x025200000x0259ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025f00000x025f00000x0266ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x026700000x0293efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000029f00000x029f00000x02a6ffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
wininit.exe0xff0b00000xff0d2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WSHTCPIP.DLL0x7fefcce00000x7fefcce6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wship6.dll0x7fefd2d00000x7fefd2d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x7fefd2e00000x7fefd334fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WlS0WndH.dll0x7fefd9e00000x7fefd9e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KBDUS.DLL0x7fefda200000x7fefda23fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #23: csrss.exe
+
InformationValue
ID / OS PID#23 / 0x164
OS Parent PID0x150 (c:\windows\system32\smss.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\csrss.exe
Command Line%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
MonitorStart Time: 00:00:54, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:34
OS Thread IDs
#221
0x168
#222
0x170
#223
0x174
#224
0x178
#225
0x17C
#232
0x19C
#244
0x1D0
#245
0x1D4
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x (null)0x000000000x000fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001000000x001000000x00100fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001000000x001000000x00106fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001100000x001100000x0011ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001200000x001200000x00121fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001300000x001300000x0016ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001700000x001700000x00170fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001800000x001800000x0027ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x002800000x002e6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000002f00000x002f00000x003effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003f00000x003f00000x00570fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005800000x005800000x00972fffPagefile Backed MemoryReadableTrueFalseFalse
vgasys.fon0x009800000x00981fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000009900000x009900000x009cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000af00000x00af00000x00b2ffffPrivate MemoryReadable, WritableTrueFalseFalse
csrss.exe0x498a00000x498a5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
sxssrv.dll0x7fefda600000x7fefda6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsrv.dll0x7fefda700000x7fefdaa7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
basesrv.dll0x7fefdab00000x7fefdac0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
csrsrv.dll0x7fefdad00000x7fefdae2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #24: winlogon.exe
+
InformationValue
ID / OS PID#24 / 0x180
OS Parent PID0x150 (c:\windows\system32\smss.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\winlogon.exe
Command Linewinlogon.exe
MonitorStart Time: 00:00:54, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:34
OS Thread IDs
#228
0x184
#238
0x1C8
#239
0x1CC
#306
0x2C4
#325
0x314
#386
0x100
#387
0x108
#390
0x134
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
locale.nls0x000200000x00086fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000900000x000900000x00096fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000a00000x000a00000x000a1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000b00000x000b00000x000b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000c00000x000c00000x000c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000d00000x000d00000x0014ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001500000x001500000x0015ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001600000x001600000x0018ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001900000x001900000x00190fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001a00000x001a00000x001a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001b00000x001b00000x0022ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002300000x002300000x00247fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002500000x002500000x002cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002d00000x002d00000x003cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003d00000x003d00000x004cffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004d00000x004d00000x00657fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006600000x006600000x007e0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007f00000x007f00000x00be2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000c000000x00c000000x00c00fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c500000x00c500000x00ccffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000cf00000x00cf00000x00d6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d700000x00d700000x00deffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000df00000x00df00000x00eeffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ef00000x00ef00000x00f6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000fb00000x00fb00000x0102ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000010400000x010400000x010bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000011900000x011900000x0120ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000012700000x012700000x012effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013000000x013000000x0137ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013b00000x013b00000x0142ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014700000x014700000x014effffPrivate MemoryReadable, WritableTrueFalseFalse
aero.msstyles0x014f00000x0160dfffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000014f00000x014f00000x015effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016600000x016600000x016dffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x016e00000x019aefffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000019b00000x019b00000x023affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000019b00000x019b00000x02daffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000002f800000x02f800000x02ffffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
winlogon.exe0xff6500000xff6b1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mpr.dll0x7fefb4300000x7fefb447fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
UXInit.dll0x7fefb5700000x7fefb579fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x7fefb5f00000x7fefb5fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x7fefbc700000x7fefbc84fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x7fefbc900000x7fefbc9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WindowsCodecs.dll0x7fefbe000000x7fefbf29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefc3a00000x7fefc3f5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netjoin.dll0x7fefd4500000x7fefd481fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdcfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #25: services.exe
+
InformationValue
ID / OS PID#25 / 0x1a8
OS Parent PID0x158 (c:\windows\system32\wininit.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\services.exe
Command LineC:\Windows\system32\services.exe
MonitorStart Time: 00:00:55, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:33
OS Thread IDs
#241
0x1AC
#260
0x208
#261
0x20C
#262
0x210
#263
0x214
#264
0x218
#265
0x21C
#266
0x220
#267
0x224
#268
0x228
#269
0x22C
#270
0x230
#287
0x270
#388
0xE8
#480
0x518
#491
0x550
#498
0x56C
#500
0x578
#608
0x72C
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x000affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000b00000x000b00000x000b3fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000c00000x000c00000x000c0fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000d00000x00136fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000001400000x001400000x00141fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001500000x001500000x00150fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001600000x001600000x0016ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001700000x001700000x00170fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001800000x001800000x00186fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000002100000x002100000x0030ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003100000x003100000x0040ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004100000x004100000x00597fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005a00000x005a00000x00720fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007300000x007300000x007effffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007f00000x007f00000x00be2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000c700000x00c700000x00ceffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d800000x00d800000x00dbffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000de00000x00de00000x00e5ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ee00000x00ee00000x00f5ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000011300000x011300000x011affffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
services.exe0xffdf00000xffe42fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ubpm.dll0x7fefced00000x7fefcf08fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
authz.dll0x7fefd5100000x7fefd53efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x7fefd8100000x7fefd832fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
scesrv.dll0x7fefd8400000x7fefd8a6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
scext.dll0x7fefd8c00000x7fefd8d8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #26: lsass.exe
+
InformationValue
ID / OS PID#26 / 0x1b8
OS Parent PID0x158 (c:\windows\system32\wininit.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\lsass.exe
Command LineC:\Windows\system32\lsass.exe
MonitorStart Time: 00:00:55, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:33
OS Thread IDs
#242
0x1BC
#247
0x1DC
#248
0x1E0
#249
0x1E4
#250
0x1E8
#251
0x1EC
#255
0x1F4
#256
0x1F8
#257
0x1FC
#258
0x200
#259
0x204
#326
0x318
#330
0x328
#389
0x130
#414
0xC4
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00020fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000c00000x000c00000x0017ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001800000x001800000x00180fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001900000x001900000x0020ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002100000x002100000x00210fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002200000x002200000x0022ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002300000x002300000x0023ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002400000x002400000x00246fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000002500000x002500000x00251fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002600000x002600000x0026ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
C_28591.NLS0x002700000x00280fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000002900000x002900000x00290fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002a00000x002a00000x002a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002b00000x002b00000x002b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002c00000x002c00000x003bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003c00000x003c00000x004bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004c00000x004c00000x004c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004d00000x004d00000x004d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004e00000x004e00000x004e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004f00000x004f00000x004f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005000000x005000000x00500fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005100000x005100000x00510fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005200000x005200000x0052ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005300000x005300000x00530fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005400000x005400000x005bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000006300000x006300000x006affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000006b00000x006b00000x00837fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008400000x008400000x009c0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000009f00000x009f00000x00a6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000a800000x00a800000x00afffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000b000000x00b000000x00b7ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000be00000x00be00000x00c5ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000000c600000x00c600000x01052fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000011200000x011200000x0119ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x011a00000x0146efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000014a00000x014a00000x0151ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015b00000x015b00000x0162ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016600000x016600000x016dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016f00000x016f00000x0176ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017000000x017000000x0177ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017800000x017800000x0187ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000018c00000x018c00000x0193ffffPrivate MemoryReadable, WritableTrueFalseFalse
msprivs.dll0x758200000x75821fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
lsass.exe0xffa400000xffa4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x7fefb5100000x7fefb51afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x7fefb5200000x7fefb546fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x7fefbc900000x7fefbc9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
scecli.dll0x7fefcf200000x7fefcf5dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf500000x7fefcf59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
efslsaext.dll0x7fefcf600000x7fefcf71fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
bcryptprimitives.dll0x7fefcf800000x7fefcfcbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pku2u.dll0x7fefcfd00000x7fefd014fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
TSpkg.dll0x7fefd0200000x7fefd037fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wdigest.dll0x7fefd0900000x7fefd0c5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
schannel.dll0x7fefd0d00000x7fefd126fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
logoncli.dll0x7fefd1300000x7fefd15ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsapi.dll0x7fefd1600000x7fefd1bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netlogon.dll0x7fefd1c00000x7fefd26dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msv1_0.dll0x7fefd2700000x7fefd2c0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wship6.dll0x7fefd2d00000x7fefd2d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x7fefd2e00000x7fefd334fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kerberos.dll0x7fefd3600000x7fefd413fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
negoexts.dll0x7fefd4200000x7fefd443fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netjoin.dll0x7fefd4500000x7fefd481fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
bcrypt.dll0x7fefd4900000x7fefd4b1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ncrypt.dll0x7fefd4c00000x7fefd50dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
authz.dll0x7fefd5100000x7fefd53efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cngaudit.dll0x7fefd5400000x7fefd548fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wevtapi.dll0x7fefd5500000x7fefd5bcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptdll.dll0x7fefd5c00000x7fefd5d3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samsrv.dll0x7fefd5e00000x7fefd69cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lsasrv.dll0x7fefd6a00000x7fefd806fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspisrv.dll0x7fefd9000000x7fefd90afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefdaf00000x7fefdafefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefdc000000x7fefdd66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffffa60000x7fffffa60000x7fffffa7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd40000x7fffffd40000x7fffffd5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd60000x7fffffd60000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #27: lsm.exe
+
InformationValue
ID / OS PID#27 / 0x1c0
OS Parent PID0x158 (c:\windows\system32\wininit.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\lsm.exe
Command LineC:\Windows\system32\lsm.exe
MonitorStart Time: 00:00:55, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:33
OS Thread IDs
#243
0x1C4
#272
0x23C
#303
0x2B8
#305
0x2C0
#307
0x2C8
#309
0x2D0
#312
0x2DC
#313
0x2E0
#314
0x2E4
#317
0x2F0
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000500000x000500000x0014ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001500000x001500000x001cffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x001d00000x00236fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000002800000x002800000x002fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003100000x003100000x0031ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003200000x003200000x0041ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004800000x004800000x004fffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x005000000x007cefffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000008100000x008100000x0088ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000a200000x00a200000x00a9ffffPrivate MemoryReadable, WritableTrueFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
lsm.exe0xff4600000xff4b6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pcwum.dll0x7fefcda00000x7fefcdacfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wmsgapi.dll0x7fefd8e00000x7fefd8e7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sysntfy.dll0x7fefd8f00000x7fefd8f9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #28: svchost.exe
+
InformationValue
ID / OS PID#28 / 0x234
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\svchost.exe
Command LineC:\Windows\system32\svchost.exe -k DcomLaunch
MonitorStart Time: 00:00:57, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:31
OS Thread IDs
#271
0x238
#273
0x240
#274
0x244
#275
0x248
#276
0x24C
#277
0x250
#278
0x254
#279
0x258
#281
0x25C
#283
0x260
#284
0x264
#285
0x268
#286
0x26C
#289
0x278
#291
0x284
#292
0x288
#294
0x290
#554
0x64C
#609
0x730
#621
0x760
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000c00000x000c00000x000c1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000d00000x000d00000x000d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000e00000x000e00000x000e0fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000f00000x000f00000x000f0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001000000x001000000x00100fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001100000x001100000x0011ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001200000x001200000x0019ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001a00000x001a00000x001a0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001b00000x001b00000x0022ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002300000x002300000x0032ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003300000x003300000x00330fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000003400000x003400000x00340fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003500000x003500000x003cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003500000x003500000x003cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003f00000x003f00000x004effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004f00000x004f00000x005affffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005b00000x005b00000x0062ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000006400000x006400000x006bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007100000x007100000x0078ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x007900000x00a5efffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x0000000000a600000x00a600000x00be7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000bf00000x00bf00000x00d70fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000d800000x00d800000x01172fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000012200000x012200000x0122ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000012400000x012400000x012bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000012c00000x012c00000x013bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013d00000x013d00000x0144ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014a00000x014a00000x0151ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015800000x015800000x015fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016300000x016300000x016affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016b00000x016b00000x0172ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017400000x017400000x017bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017f00000x017f00000x0186ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019200000x019200000x0199ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019f00000x019f00000x01a6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001a700000x01a700000x01b6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001ba00000x01ba00000x01c1ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001c500000x01c500000x01ccffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e900000x01e900000x01f0ffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
svchost.exe0xffa200000xffa2afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemprox.dll0x7fef83300000x7fef833efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdsapi.dll0x7fef83d00000x7fef83f6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
fastprox.dll0x7fef84000000x7fef84e1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WmiDcPrv.dll0x7fef84f00000x7fef8521fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemcomn.dll0x7fef87000000x7fef8785fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x7fefb9c00000x7fefb9ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wtsapi32.dll0x7fefbdd00000x7fefbde0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcss.dll0x7fefcd100000x7fefcd90fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x7fefcd700000x7fefcd9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pcwum.dll0x7fefcda00000x7fefcdacfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
umpo.dll0x7fefcdb00000x7fefcddbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gpapi.dll0x7fefcde00000x7fefcdfafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devrtl.dll0x7fefce200000x7fefce31fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
SPInf.dll0x7fefce400000x7fefce5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
umpnpmgr.dll0x7fefce600000x7fefcec6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefdaf00000x7fefdafefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wintrust.dll0x7fefdb000000x7fefdb39fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x7fefdb400000x7fefdb59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefdc000000x7fefdd66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x7fefe1700000x7fefe346fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x7fefec200000x7fefec71fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffff9c0000x7fffff9c0000x7fffff9dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9e0000x7fffff9e0000x7fffff9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa00000x7fffffa00000x7fffffa1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa20000x7fffffa20000x7fffffa3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa40000x7fffffa40000x7fffffa5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa60000x7fffffa60000x7fffffa7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #29: svchost.exe
+
InformationValue
ID / OS PID#29 / 0x27c
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\svchost.exe
Command LineC:\Windows\system32\svchost.exe -k RPCSS
MonitorStart Time: 00:00:58, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:30
OS Thread IDs
#290
0x280
#293
0x28C
#295
0x294
#296
0x298
#297
0x29C
#298
0x2A0
#299
0x2A4
#300
0x2A8
#548
0x638
#590
0x6E4
#592
0x6EC
#595
0x6F8
#612
0x73C
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000c00000x000c00000x000c6fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000d00000x000d00000x000d1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000e00000x000e00000x000e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000f00000x000f00000x000f0fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001000000x001000000x00100fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001100000x001100000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001900000x001900000x0028ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002900000x002900000x00290fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002e00000x002e00000x003dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003e00000x003e00000x0045ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004e00000x004e00000x0055ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000006100000x006100000x0068ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000006900000x006900000x0074ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000006e00000x006e00000x0075ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x007600000x00a2efffMemory Mapped FileReadableFalseFalseFalse
private_0x0000000000ac00000x00ac00000x00b3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000b700000x00b700000x00beffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c800000x00c800000x00cfffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000000d000000x00d000000x00e87fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000e900000x00e900000x01010fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000010200000x010200000x01412fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000014200000x014200000x0151ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016100000x016100000x0168ffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
svchost.exe0xffa200000xffa2afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FWPUCLNT.DLL0x7fefab700000x7fefabc2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x7fefcc100000x7fefcc1bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FirewallAPI.dll0x7fefcc200000x7fefccdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WSHTCPIP.DLL0x7fefcce00000x7fefcce6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcEpMap.dll0x7fefccf00000x7fefcd03fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcss.dll0x7fefcd100000x7fefcd90fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wship6.dll0x7fefd2d00000x7fefd2d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x7fefd2e00000x7fefd334fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdcfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #30: svchost.exe
+
InformationValue
ID / OS PID#30 / 0x2ac
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\svchost.exe
Command LineC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
MonitorStart Time: 00:00:59, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:29
OS Thread IDs
#302
0x2B0
#304
0x2BC
#308
0x2CC
#310
0x2D4
#311
0x2D8
#316
0x2EC
#324
0x2FC
#333
0x338
#334
0x33C
#335
0x340
#337
0x344
#338
0x348
#353
0x388
#354
0x38C
#355
0x390
#358
0x3A0
#359
0x3A4
#416
0xFC
#421
0x40C
#423
0x418
#426
0x428
#433
0x444
#434
0x448
#512
0x5AC
#561
0x66C
#565
0x67C
#569
0x68C
#572
0x698
#575
0x6A4
#576
0x6A8
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000500000x000500000x00051fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000600000x000600000x00060fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000700000x000700000x0016ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x001700000x001d6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001e00000x001e00000x001e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001f00000x001f00000x0020ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002100000x002100000x0028ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002900000x002900000x002cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002d00000x002d00000x002d7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002e00000x002e00000x002fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003000000x003000000x0031ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003200000x003200000x0032ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003300000x003300000x0042ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004300000x004300000x005b7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005c00000x005c00000x00740fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007500000x007500000x0080ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008100000x008100000x00c02fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000c100000x00c100000x00c10fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000c200000x00c200000x00c20fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000c300000x00c300000x00c30fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c400000x00c400000x00c40fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000000c500000x00c500000x00c50fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c700000x00c700000x00ceffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d100000x00d100000x00d8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000db00000x00db00000x00e2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000e300000x00e300000x00f2ffffPrivate MemoryReadable, WritableTrueFalseFalse
winlogon.exe0x00f300000x00f91fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x0000000000f900000x00f900000x0100ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x010100000x012defffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000013200000x013200000x0139ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013e00000x013e00000x0145ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014c00000x014c00000x0153ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015800000x015800000x015fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016000000x016000000x0167ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016400000x016400000x016bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016e00000x016e00000x0175ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017600000x017600000x0185ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000018900000x018900000x0190ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019400000x019400000x019bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019d00000x019d00000x01a4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001a600000x01a600000x01adffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001a800000x01a800000x01afffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001b000000x01b000000x01cfffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d600000x01d600000x01ddffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e400000x01e400000x01ebffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f100000x01f100000x01f8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020500000x020500000x020cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000021000000x021000000x0217ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022100000x022100000x0228ffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
winlogon.exe0xff6500000xff6b1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
svchost.exe0xffa200000xffa2afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
services.exe0xffdf00000xffe42fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc.dll0x7fefab200000x7fefab37fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc6.dll0x7fefab400000x7fefab50fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcore6.dll0x7fefac000000x7fefac3afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcore.dll0x7fefac400000x7fefac90fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nrpsrv.dll0x7fefacb00000x7fefacb7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lmhsvc.dll0x7fefacc00000x7fefacc9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x7fefb5100000x7fefb51afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x7fefb5200000x7fefb546fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
avrt.dll0x7fefba100000x7fefba18fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x7fefba200000x7fefba4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
audiosrv.dll0x7fefba500000x7fefbafbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x7fefbad00000x7fefbafbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
MMDevAPI.dll0x7fefbf900000x7fefbfdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x7fefc4000000x7fefc52bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wevtsvc.dll0x7fefca700000x7fefcc05fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x7fefcc100000x7fefcc1bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FirewallAPI.dll0x7fefcc200000x7fefccdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WSHTCPIP.DLL0x7fefcce00000x7fefcce6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gpapi.dll0x7fefcde00000x7fefcdfafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsapi.dll0x7fefd1600000x7fefd1bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wship6.dll0x7fefd2d00000x7fefd2d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x7fefd2e00000x7fefd334fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wevtapi.dll0x7fefd5500000x7fefd5bcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x7fefdb400000x7fefdb59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x7fefe1700000x7fefe346fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffff960000x7fffff960000x7fffff97fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff980000x7fffff980000x7fffff99fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9a0000x7fffff9a0000x7fffff9bfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9c0000x7fffff9c0000x7fffff9dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9e0000x7fffff9e0000x7fffff9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa00000x7fffffa00000x7fffffa1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa20000x7fffffa20000x7fffffa3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa40000x7fffffa40000x7fffffa5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa60000x7fffffa60000x7fffffa7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdcfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #31: logonui.exe
+
InformationValue
ID / OS PID#31 / 0x2f4
OS Parent PID0x180 (c:\windows\system32\winlogon.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\logonui.exe
Command Line"LogonUI.exe" /flags:0x0
MonitorStart Time: 00:00:59, Reason: Child Process
UnmonitorEnd Time: 00:01:15, Reason: Terminated
Monitor Duration00:00:16
OS Thread IDs
#318
0x2F8
#319
0x300
#320
0x304
#321
0x308
#322
0x30C
#323
0x310
#327
0x31C
#328
0x320
#329
0x324
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00041fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000c00000x000c00000x000effffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000f00000x000f00000x000f0fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001000000x001000000x00100fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001100000x001100000x00110fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001200000x001200000x00121fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001300000x001300000x00131fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001400000x001400000x00141fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001500000x001500000x00151fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001600000x001600000x00166fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001700000x001700000x001effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001f00000x001f00000x002effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002f00000x002f00000x002f1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000003000000x003000000x003fffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004000000x004000000x00587fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005900000x005900000x005cffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005d00000x005d00000x005d1fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005e00000x005e00000x005effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005f00000x005f00000x00770fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000007800000x007800000x00780fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007900000x007900000x00790fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007a00000x007a00000x007a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007b00000x007b00000x007b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007c00000x007c00000x007c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007d00000x007d00000x007d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007e00000x007e00000x007e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007f00000x007f00000x007f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008000000x008000000x00800fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008100000x008100000x00810fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008200000x008200000x00820fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008300000x008300000x00830fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008400000x008400000x00840fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008500000x008500000x00850fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008600000x008600000x0086ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008700000x008700000x00870fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008800000x008800000x008fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009000000x009000000x00900fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009100000x009100000x00910fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009200000x009200000x00920fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009300000x009300000x009affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009b00000x009b00000x00a2ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x00a300000x00cfefffMemory Mapped FileReadableFalseFalseFalse
private_0x0000000000d000000x00d000000x00d00fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d100000x00d100000x00d10fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d200000x00d200000x00d20fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d300000x00d300000x00d30fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d400000x00d400000x00d40fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d500000x00d500000x00d50fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d600000x00d600000x00d60fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d700000x00d700000x00d70fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d800000x00d800000x00d80fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d900000x00d900000x00d90fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000da00000x00da00000x00e1ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000000e200000x00e200000x01212fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000012200000x012200000x0131ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013200000x013200000x01320fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013300000x013300000x01330fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013400000x013400000x01340fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013500000x013500000x01350fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013600000x013600000x01360fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013700000x013700000x01370fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013800000x013800000x01380fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013900000x013900000x01390fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013a00000x013a00000x013a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013b00000x013b00000x013b6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013c00000x013c00000x013c9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013d00000x013d00000x013d6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013e00000x013e00000x01403fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014100000x014100000x01419fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014200000x014200000x01426fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014300000x014300000x01439fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014400000x014400000x01446fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014500000x014500000x01487fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014900000x014900000x01499fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014a00000x014a00000x014a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014b00000x014b00000x014b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014c00000x014c00000x014c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014d00000x014d00000x014d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014e00000x014e00000x014e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014f00000x014f00000x014f1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015000000x015000000x01500fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015100000x015100000x01511fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015200000x015200000x01520fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015300000x015300000x01531fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015400000x015400000x01540fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015500000x015500000x01551fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015600000x015600000x01560fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015700000x015700000x01570fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015800000x015800000x01580fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015900000x015900000x01590fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015a00000x015a00000x015a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015b00000x015b00000x015b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015c00000x015c00000x015c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015d00000x015d00000x015d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015e00000x015e00000x015e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015f00000x015f00000x015f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016000000x016000000x01600fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016100000x016100000x01610fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016200000x016200000x01620fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016300000x016300000x01630fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016400000x016400000x01640fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016500000x016500000x01650fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016600000x016600000x01660fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016700000x016700000x01670fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016800000x016800000x0177ffffPrivate MemoryReadable, WritableTrueFalseFalse
imageres.dll0x017800000x02ad4fffMemory Mapped FileReadableFalseFalseFalse
private_0x0000000002ae00000x02ae00000x02ae0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002af00000x02af00000x02b01fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000002b100000x02b100000x02b11fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000002b200000x02b200000x02b21fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000002b300000x02b300000x02b32fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000002b400000x02b400000x02b4ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
KernelBase.dll.mui0x02b500000x02c0ffffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x0000000002c100000x02c100000x02c15fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002c200000x02c200000x02c20fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002c300000x02c300000x02caffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002cb00000x02cb00000x02cb7fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000002cc00000x02cc00000x02d9efffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000002da00000x02da00000x02da0fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x0000000002db00000x02db00000x02dbffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002dc00000x02dc00000x02e3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002e700000x02e700000x02eeffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002fa00000x02fa00000x0301ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000030700000x030700000x030effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031200000x031200000x0319ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033900000x033900000x0340ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000034d00000x034d00000x034d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000034e00000x034e00000x034e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000034f00000x034f00000x035effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000035f00000x035f00000x035f1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000036000000x036000000x03af1fffPrivate MemoryReadable, WritableTrueFalseFalse
StaticCache.dat0x03b000000x0442ffffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000044300000x044300000x04430fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000044400000x044400000x04440fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000044500000x044500000x04450fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000044600000x044600000x04460fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000044700000x044700000x04470fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000044800000x044800000x0467ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046800000x046800000x04680fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046900000x046900000x04690fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046a00000x046a00000x046a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046b00000x046b00000x046b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046c00000x046c00000x046c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046d00000x046d00000x046d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046e00000x046e00000x046e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046f00000x046f00000x046f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047000000x047000000x04700fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047100000x047100000x04710fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047200000x047200000x04720fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047300000x047300000x04730fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047400000x047400000x04740fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047500000x047500000x04750fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047600000x047600000x04760fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047700000x047700000x04770fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047800000x047800000x04780fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047900000x047900000x04790fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047a00000x047a00000x047a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047b00000x047b00000x047b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047c00000x047c00000x047c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047d00000x047d00000x047d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047e00000x047e00000x047e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000047f00000x047f00000x047f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048000000x048000000x04800fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048100000x048100000x04810fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048200000x048200000x04820fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048300000x048300000x04830fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048400000x048400000x04840fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048500000x048500000x04856fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048600000x048600000x04869fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048700000x048700000x04876fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048800000x048800000x048a3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048b00000x048b00000x048b9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048c00000x048c00000x048c6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048d00000x048d00000x048d9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048e00000x048e00000x048e6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048f00000x048f00000x04927fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049300000x049300000x04939fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049400000x049400000x04940fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049500000x049500000x04950fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049600000x049600000x04960fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049700000x049700000x04970fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049800000x049800000x04980fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049900000x049900000x04991fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049a00000x049a00000x049a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049b00000x049b00000x049b1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049c00000x049c00000x049c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049d00000x049d00000x049d1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049e00000x049e00000x049e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000049f00000x049f00000x049f1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a000000x04a000000x04a00fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a100000x04a100000x04a10fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a200000x04a200000x04a20fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a300000x04a300000x04a30fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a400000x04a400000x04a40fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a500000x04a500000x04a50fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a600000x04a600000x04a60fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a700000x04a700000x04a70fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a800000x04a800000x04a80fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004a900000x04a900000x04a90fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004aa00000x04aa00000x04aa0fffPrivate MemoryReadable, WritableTrueFalseFalse
imageres.dll0x744c00000x75815fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
LogonUI.exe0xff3f00000xff3fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rtutils.dll0x7fefbb000000x7fefbb10fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rasman.dll0x7fefbb200000x7fefbb3bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rasapi32.dll0x7fefbb400000x7fefbba1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rasplap.dll0x7fefbbb00000x7fefbc17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
certCredProvider.dll0x7fefbc200000x7fefbc42fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samcli.dll0x7fefbc500000x7fefbc63fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x7fefbc700000x7fefbc84fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x7fefbc900000x7fefbc9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netapi32.dll0x7fefbca00000x7fefbcb5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
vaultcli.dll0x7fefbcc00000x7fefbccdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credui.dll0x7fefbcd00000x7fefbd03fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winbio.dll0x7fefbd100000x7fefbd26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
BioCredProv.dll0x7fefbd300000x7fefbd61fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
SmartcardCredentialProvider.dll0x7fefbd700000x7fefbda1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
VaultCredProvider.dll0x7fefbdb00000x7fefbdc7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wtsapi32.dll0x7fefbdd00000x7fefbde0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winbrand.dll0x7fefbdf00000x7fefbdf7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WindowsCodecs.dll0x7fefbe000000x7fefbf29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
xmllite.dll0x7fefbf300000x7fefbf64fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x7fefbf700000x7fefbf87fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
MMDevAPI.dll0x7fefbf900000x7fefbfdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
hid.dll0x7fefbfe00000x7fefbfeafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
SndVolSSO.dll0x7fefbff00000x7fefc02afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
duser.dll0x7fefc0300000x7fefc072fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dui70.dll0x7fefc0800000x7fefc171fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
GdiPlus.dll0x7fefc1800000x7fefc394fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefc3a00000x7fefc3f5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x7fefc4000000x7fefc52bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samlib.dll0x7fefc5300000x7fefc54cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shacct.dll0x7fefc5500000x7fefc573fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x7fefc5800000x7fefc773fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptui.dll0x7fefc7800000x7fefc888fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
authui.dll0x7fefc8900000x7fefca69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netjoin.dll0x7fefd4500000x7fefd481fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x7fefd8100000x7fefd832fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefdaf00000x7fefdafefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wintrust.dll0x7fefdb000000x7fefdb39fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x7fefdb400000x7fefdb59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefdc000000x7fefdd66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x7fefe1700000x7fefe346fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefe8600000x7fefe8d0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd40000x7fffffd40000x7fffffd5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd60000x7fffffd60000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #32: svchost.exe
+
InformationValue
ID / OS PID#32 / 0x32c
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\svchost.exe
Command LineC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
MonitorStart Time: 00:01:02, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:26
OS Thread IDs
#331
0x330
#332
0x334
#339
0x34C
#340
0x350
#341
0x354
#343
0x360
#345
0x368
#346
0x36C
#347
0x370
#348
0x374
#363
0x3B4
#364
0x3B8
#368
0x3CC
#369
0x3D0
#370
0x3D4
#372
0x3DC
#376
0x3F0
#377
0x3F4
#412
0x3BC
#413
0x100
#427
0x42C
#429
0x434
#601
0x710
#603
0x718
#604
0x71C
#605
0x720
#607
0x728
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000500000x000500000x00051fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000600000x000600000x00060fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000700000x000700000x000effffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x000f00000x00156fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001600000x001600000x00160fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001700000x001700000x0026ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002700000x002700000x0036ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003700000x003700000x00370fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000003800000x003800000x00380fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003900000x003900000x00390fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003a00000x003a00000x003a0fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003b00000x003b00000x003b1fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003c00000x003c00000x003cffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003d00000x003d00000x00557fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005600000x005600000x006e0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006f00000x006f00000x007affffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007b00000x007b00000x00ba2fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000bb00000x00bb00000x00bb1fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000bc00000x00bc00000x00bc1fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000bf00000x00bf00000x00c6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c700000x00c700000x00ceffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000cf00000x00cf00000x00d6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d300000x00d300000x00daffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d700000x00d700000x00deffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000df00000x00df00000x00e6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000e100000x00e100000x00e8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000eb00000x00eb00000x00f2ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x00f300000x011fefffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000012900000x012900000x0130ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013300000x013300000x013affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013e00000x013e00000x0145ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014d00000x014d00000x0154ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015500000x015500000x015cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015d00000x015d00000x0164ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016e00000x016e00000x0175ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017d00000x017d00000x0184ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000018c00000x018c00000x0193ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019e00000x019e00000x019effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001a500000x01a500000x01acffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001ad00000x01ad00000x01b4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001b800000x01b800000x01bfffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001c000000x01c000000x01c0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001c700000x01c700000x01ceffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d300000x01d300000x01daffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e800000x01e800000x01efffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f000000x01f000000x01ffffffPrivate MemoryReadable, WritableTrueFalseFalse
sfc.dll0x74e100000x74e12fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
svchost.exe0xffa200000xffa2afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
trkwks.dll0x7fef87d00000x7fef87f1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sysmain.dll0x7fef88000000x7fef89adfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sfc_os.dll0x7fef89b00000x7fef89bffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
aepic.dll0x7fef89c00000x7fef89d1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pcasvc.dll0x7fef89e00000x7fef8a11fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cscobj.dll0x7fef95100000x7fef954efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxsms.dll0x7fefaff00000x7fefaffffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apphelp.dll0x7fefb2000000x7fefb256fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mstask.dll0x7fefb6200000x7fefb65cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
taskschd.dll0x7fefb6600000x7fefb786fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
PeerDist.dll0x7fefb8e00000x7fefb90ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cscsvc.dll0x7fefb9100000x7fefb9bbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x7fefb9c00000x7fefb9ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
avrt.dll0x7fefba100000x7fefba18fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x7fefba200000x7fefba4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
audiosrv.dll0x7fefba500000x7fefbafbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wtsapi32.dll0x7fefbdd00000x7fefbde0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
MMDevAPI.dll0x7fefbf900000x7fefbfdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x7fefc4000000x7fefc52bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x7fefc5800000x7fefc773fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x7fefcc100000x7fefcc1bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pcwum.dll0x7fefcda00000x7fefcdacfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gpapi.dll0x7fefcde00000x7fefcdfafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
authz.dll0x7fefd5100000x7fefd53efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wevtapi.dll0x7fefd5500000x7fefd5bcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x7fefdb400000x7fefdb59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x7fefe1700000x7fefe346fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefe8600000x7fefe8d0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x7fefec200000x7fefec71fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x7feff0800000x7feffe07fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffff920000x7fffff920000x7fffff93fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff940000x7fffff940000x7fffff95fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff960000x7fffff960000x7fffff97fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff980000x7fffff980000x7fffff99fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9a0000x7fffff9a0000x7fffff9bfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9c0000x7fffff9c0000x7fffff9dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9e0000x7fffff9e0000x7fffff9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa00000x7fffffa00000x7fffffa1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa20000x7fffffa20000x7fffffa3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa40000x7fffffa40000x7fffffa5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa60000x7fffffa60000x7fffffa7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #33: svchost.exe
+
InformationValue
ID / OS PID#33 / 0x358
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\svchost.exe
Command LineC:\Windows\system32\svchost.exe -k netsvcs
MonitorStart Time: 00:01:02, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:26
OS Thread IDs
#342
0x35C
#344
0x364
#349
0x378
#350
0x37C
#351
0x380
#352
0x384
#365
0x3BC
#367
0x3C8
#371
0x3D8
#374
0x3E8
#375
0x3EC
#383
0xF0
#385
0x104
#391
0x138
#399
0x1A0
#400
0x1FC
#440
0x460
#442
0x468
#463
0x4C0
#465
0x4D0
#466
0x278
#467
0x4D8
#475
0xC4
#481
0x51C
#606
0x724
#610
0x734
#611
0x738
#613
0x740
#614
0x744
#615
0x748
#616
0x74C
#617
0x750
#618
0x754
#620
0x75C
#622
0x764
#624
0x76C
#626
0x774
#629
0x780
#631
0x788
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000000c00000x000c00000x001bffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001c00000x001c00000x001c1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001d00000x001d00000x0024ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002500000x002500000x0030ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003100000x003100000x00310fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003200000x003200000x00320fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003300000x003300000x00330fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000003400000x003400000x00340fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003500000x003500000x00350fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003600000x003600000x00360fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003700000x003700000x0046ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004700000x004700000x005f7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006000000x006000000x00601fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x006100000x00613fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000006200000x006200000x00621fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000006300000x006300000x0063ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000006400000x006400000x007c0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007d00000x007d00000x00bc2fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x00bd00000x00bd3fffMemory Mapped FileReadableTrueFalseFalse
private_0x0000000000bf00000x00bf00000x00c6ffffPrivate MemoryReadable, WritableTrueFalseFalse
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db0x00c700000x00c9ffffMemory Mapped FileReadableTrueFalseFalse
private_0x0000000000cd00000x00cd00000x00d4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d900000x00d900000x00e0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000e500000x00e500000x00e5ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000e600000x00e600000x00edffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x00ee00000x011aefffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000011b00000x011b00000x0122ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000012500000x012500000x012cffffPrivate MemoryReadable, WritableTrueFalseFalse
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db0x012d00000x01335fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000013400000x013400000x0134ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013500000x013500000x013cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013700000x013700000x013effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014300000x014300000x014affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015000000x015000000x0157ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015100000x015100000x0158ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015a00000x015a00000x0161ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016200000x016200000x0169ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016a00000x016a00000x0171ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016c00000x016c00000x0173ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017800000x017800000x017fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000018300000x018300000x018affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019000000x019000000x0197ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019b00000x019b00000x01a2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001a300000x01a300000x01aaffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001a600000x01a600000x01adffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001b200000x01b200000x01b9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001bb00000x01bb00000x01c2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001c500000x01c500000x01ccffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d300000x01d300000x01daffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001dd00000x01dd00000x01e4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e900000x01e900000x01f0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f100000x01f100000x0200ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020300000x020300000x020affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020b00000x020b00000x0212ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000021400000x021400000x021bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022000000x022000000x0227ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022c00000x022c00000x0233ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022c00000x022c00000x0233ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022e00000x022e00000x0235ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000023a00000x023a00000x0241ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000024200000x024200000x0249ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025000000x025000000x0257ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025a00000x025a00000x0261ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000026500000x026500000x026cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000026d00000x026d00000x0274ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000027d00000x027d00000x0284ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000028500000x028500000x0294ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000029500000x029500000x02a4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002a500000x02a500000x02b4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002bf00000x02bf00000x02bfffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002c000000x02c000000x02c7ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002c800000x02c800000x02d7ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002e000000x02e000000x02e0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002e700000x02e700000x02eeffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002f500000x02f500000x02fcffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000030a00000x030a00000x0311ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031500000x031500000x031cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033000000x033000000x0337ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033f00000x033f00000x0346ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000034b00000x034b00000x0352ffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
svchost.exe0xffa200000xffa2afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
repdrvfs.dll0x7fef7f300000x7fef7fa2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wmiutils.dll0x7fef7fb00000x7fef7fd5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netprofm.dll0x7fef7fe00000x7fef8053fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
hnetcfg.dll0x7fef80600000x7fef80cafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemsvc.dll0x7fef80d00000x7fef80e3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
esscli.dll0x7fef80f00000x7fef815efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemcore.dll0x7fef81600000x7fef828efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
resutils.dll0x7fef82900000x7fef82a8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clusapi.dll0x7fef82b00000x7fef82fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sscore.dll0x7fef83000000x7fef8307fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nci.dll0x7fef83100000x7fef8329fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemprox.dll0x7fef83300000x7fef833efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netcfgx.dll0x7fef83400000x7fef83c3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdsapi.dll0x7fef83d00000x7fef83f6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
fastprox.dll0x7fef84000000x7fef84e1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
browser.dll0x7fef85300000x7fef8554fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvsvc.dll0x7fef85600000x7fef859cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wdscore.dll0x7fef85a00000x7fef85e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sqmapi.dll0x7fef85f00000x7fef8631fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rtutils.dll0x7fef86400000x7fef8650fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iphlpsvc.dll0x7fef86600000x7fef86f1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wbemcomn.dll0x7fef87000000x7fef8785fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WMIsvc.dll0x7fef87900000x7fef87cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
vsstrace.dll0x7fef8b000000x7fef8b16fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
vssapi.dll0x7fef8b200000x7fef8ccffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
taskcomp.dll0x7fefa0c00000x7fefa136fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wiarpc.dll0x7fefa3000000x7fefa30efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ktmw32.dll0x7fefa3100000x7fefa319fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
schedsvc.dll0x7fefa3200000x7fefa431fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
actxprxy.dll0x7fefa9500000x7fefaa3dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
fvecerts.dll0x7fefaa400000x7fefaa48fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
tbs.dll0x7fefaa500000x7fefaa58fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
fveapi.dll0x7fefaa600000x7fefaab5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shsvcs.dll0x7fefaac00000x7fefab1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc.dll0x7fefab200000x7fefab37fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc6.dll0x7fefab400000x7fefab50fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FWPUCLNT.DLL0x7fefab700000x7fefabc2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x7fefb5100000x7fefb51afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x7fefb5200000x7fefb546fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Sens.dll0x7fefb5500000x7fefb563fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
es.dll0x7fefb5800000x7fefb5e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x7fefb5f00000x7fefb5fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dsrole.dll0x7fefb6000000x7fefb60bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
themeservice.dll0x7fefb6100000x7fefb61ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
atl.dll0x7fefb7900000x7fefb7a8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profsvc.dll0x7fefb7b00000x7fefb7e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nlaapi.dll0x7fefb7f00000x7fefb804fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gpsvc.dll0x7fefb8100000x7fefb8d1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x7fefb9c00000x7fefb9ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mmcss.dll0x7fefb9f00000x7fefba0cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
avrt.dll0x7fefba100000x7fefba18fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samcli.dll0x7fefbc500000x7fefbc63fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x7fefbc700000x7fefbc84fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x7fefbc900000x7fefbc9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netapi32.dll0x7fefbca00000x7fefbcb5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wtsapi32.dll0x7fefbdd00000x7fefbde0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
xmllite.dll0x7fefbf300000x7fefbf64fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefc3a00000x7fefc3f5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x7fefc4000000x7fefc52bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samlib.dll0x7fefc5300000x7fefc54cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x7fefc5800000x7fefc773fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x7fefcc100000x7fefcc1bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FirewallAPI.dll0x7fefcc200000x7fefccdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WSHTCPIP.DLL0x7fefcce00000x7fefcce6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pcwum.dll0x7fefcda00000x7fefcdacfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gpapi.dll0x7fefcde00000x7fefcdfafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devrtl.dll0x7fefce200000x7fefce31fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ubpm.dll0x7fefced00000x7fefcf08fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
logoncli.dll0x7fefd1300000x7fefd15ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsapi.dll0x7fefd1600000x7fefd1bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wship6.dll0x7fefd2d00000x7fefd2d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x7fefd2e00000x7fefd334fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netjoin.dll0x7fefd4500000x7fefd481fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
authz.dll0x7fefd5100000x7fefd53efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wevtapi.dll0x7fefd5500000x7fefd5bcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptdll.dll0x7fefd5c00000x7fefd5d3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x7fefd8100000x7fefd832fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sysntfy.dll0x7fefd8f00000x7fefd8f9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sxs.dll0x7fefd9500000x7fefd9e0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefdaf00000x7fefdafefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wintrust.dll0x7fefdb000000x7fefdb39fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x7fefdb400000x7fefdb59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefdc000000x7fefdd66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x7fefe1700000x7fefe346fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefe8600000x7fefe8d0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x7fefec200000x7fefec71fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x7feff0800000x7feffe07fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffff7c0000x7fffff7c0000x7fffff7dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff7e0000x7fffff7e0000x7fffff7ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff800000x7fffff800000x7fffff81fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff820000x7fffff820000x7fffff83fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff840000x7fffff840000x7fffff85fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff860000x7fffff860000x7fffff87fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff880000x7fffff880000x7fffff89fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff8a0000x7fffff8a0000x7fffff8bfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff8c0000x7fffff8c0000x7fffff8dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff8e0000x7fffff8e0000x7fffff8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff900000x7fffff900000x7fffff91fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff920000x7fffff920000x7fffff93fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff920000x7fffff920000x7fffff93fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff940000x7fffff940000x7fffff95fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff960000x7fffff960000x7fffff97fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff980000x7fffff980000x7fffff99fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9a0000x7fffff9a0000x7fffff9bfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9c0000x7fffff9c0000x7fffff9dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9e0000x7fffff9e0000x7fffff9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa00000x7fffffa00000x7fffffa1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa20000x7fffffa20000x7fffffa3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa40000x7fffffa40000x7fffffa5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa40000x7fffffa40000x7fffffa5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa60000x7fffffa60000x7fffffa7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #34: audiodg.exe
+
InformationValue
ID / OS PID#34 / 0x394
OS Parent PID0x2ac (c:\windows\system32\svchost.exe)
Initial Working DirectoryC:\Windows
File Namec:\windows\system32\audiodg.exe
Command LineC:\Windows\system32\AUDIODG.EXE 0x2bc
MonitorStart Time: 00:01:02, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:26
OS Thread IDs
#356
0x398
#357
0x39C
#360
0x3A8
#361
0x3AC
#362
0x3B0
#529
0x5E4
#535
0x5FC
#540
0x618
#547
0x634
#549
0x640
#550
0x63C
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
locale.nls0x000200000x00086fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000900000x000900000x00096fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000a00000x000a00000x000a1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
audiodg.exe.mui0x000b00000x000b0fffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000000c00000x000c00000x000c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000d00000x000d00000x000d0fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000e00000x000e00000x000e0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000f00000x000f00000x0016ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001700000x001700000x0026ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002700000x002700000x0027ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002800000x002800000x0033ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003400000x003400000x0043ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004400000x004400000x005c7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005d00000x005d00000x00750fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000007600000x007600000x00761fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000007700000x007700000x00770fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000007800000x007800000x00781fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007900000x007900000x00791fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007a00000x007a00000x007a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007b00000x007b00000x007b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007c00000x007c00000x0083ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008400000x008400000x00841fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008500000x008500000x00850fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008600000x008600000x00861fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008800000x008800000x008fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009000000x009000000x0097ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x009800000x00c4efffMemory Mapped FileReadableFalseFalseFalse
private_0x0000000000c600000x00c600000x00cdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ce00000x00ce00000x010e2fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000010f00000x010f00000x014f2fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000015000000x015000000x018f2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000019000000x019000000x01d02fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d100000x01d100000x01d51fffPrivate MemoryReadable, WritableTrueFalseFalse
ksuser.dll0x73f700000x73f75fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
audiodg.exe0xffb800000xffba3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mfplat.dll0x7fef9bf00000x7fef9c5bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WMALFXGFXDSP.dll0x7fef9c600000x7fef9de7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
AUDIOKSE.dll0x7fef9ea00000x7fef9f1ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
AudioEng.dll0x7fef9f200000x7fef9f90fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x7fefb9c00000x7fefb9ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
avrt.dll0x7fefba100000x7fefba18fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
AudioSes.dll0x7fefbd800000x7fefbdcefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
MMDevAPI.dll0x7fefbf900000x7fefbfdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x7fefc4000000x7fefc52bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefdaf00000x7fefdafefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wintrust.dll0x7fefdb000000x7fefdb39fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x7fefdb400000x7fefdb59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefdc000000x7fefdd66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x7fefe1700000x7fefe346fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefe8600000x7fefe8d0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x7fefec200000x7fefec71fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdcfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #35: svchost.exe
+
InformationValue
ID / OS PID#35 / 0x3e0
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\svchost.exe
Command LineC:\Windows\system32\svchost.exe -k LocalService
MonitorStart Time: 00:01:03, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:25
OS Thread IDs
#373
0x3E4
#378
0x3F8
#379
0x3FC
#380
0xC0
#381
0xC4
#382
0xF4
#384
0xF8
#418
0x3BC
#520
0x5C4
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000500000x000500000x00051fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000600000x000600000x0015ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x001600000x001c6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001d00000x001d00000x0024ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002500000x002500000x0034ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003500000x003500000x00350fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003600000x003600000x00360fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003700000x003700000x00370fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003900000x003900000x0039ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003a00000x003a00000x00527fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005300000x005300000x006b0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006c00000x006c00000x0077ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007800000x007800000x00b72fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000b800000x00b800000x00bfffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c200000x00c200000x00c9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ca00000x00ca00000x00d1ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d500000x00d500000x00dcffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x00dd00000x0109efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000010c00000x010c00000x0113ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000011400000x011400000x0123ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000012600000x012600000x012dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013d00000x013d00000x0144ffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
svchost.exe0xffa200000xffa2afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsisvc.dll0x7fefaca00000x7fefaca9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
es.dll0x7fefb5800000x7fefb5e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd40000x7fffffd40000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd60000x7fffffd60000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #36: dllhost.exe
+
InformationValue
ID / OS PID#36 / 0x12c
OS Parent PID0x234 (c:\windows\system32\svchost.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\dllhost.exe
Command LineC:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
MonitorStart Time: 00:01:05, Reason: Child Process
UnmonitorEnd Time: 00:01:13, Reason: Terminated
Monitor Duration00:00:08
OS Thread IDs
#392
0x124
#393
0x120
#394
0x13C
#395
0x168
#396
0x154
#397
0x150
#398
0xFC
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000400000x000400000x00040fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000500000x000500000x00050fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00060fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000700000x000700000x00070fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000900000x000900000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x001900000x001f6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000002700000x002700000x0027ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003100000x003100000x0040ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004100000x004100000x0050ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005100000x005100000x00697fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006a00000x006a00000x00820fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008300000x008300000x008effffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000009500000x009500000x00a4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ab00000x00ab00000x00baffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c000000x00c000000x00cfffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x00d000000x00fcefffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000010400000x010400000x0113ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000011d00000x011d00000x011dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000012200000x012200000x0131ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013200000x013200000x0141ffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
dllhost.exe0xffe600000xffe66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IDStore.dll0x7fefb4500000x7fefb461fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x7fefb4700000x7fefb50ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x7fefb9c00000x7fefb9ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samlib.dll0x7fefc5300000x7fefc54cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shacct.dll0x7fefc5500000x7fefc573fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefe8600000x7fefe8d0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x7fefec200000x7fefec71fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x7feff0800000x7feffe07fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #37: userinit.exe
+
InformationValue
ID / OS PID#37 / 0x10c
OS Parent PID0x180 (c:\windows\system32\winlogon.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\userinit.exe
Command LineC:\Windows\system32\userinit.exe
MonitorStart Time: 00:01:06, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:22
OS Thread IDs
#401
0x1BC
#507
0x598
#509
0x5A0
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x000affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000b00000x000b00000x000b3fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000c00000x000c00000x000c0fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000d00000x00136fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001400000x001400000x0023ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002400000x002400000x00241fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000002500000x002500000x00250fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002600000x002600000x00260fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002700000x002700000x00270fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002800000x002800000x00280fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002b00000x002b00000x003affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003b00000x003b00000x00537fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005900000x005900000x0059ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005a00000x005a00000x00720fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007300000x007300000x01b2ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001b300000x01b300000x01f22fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001f300000x01f300000x0200efffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000020500000x020500000x020cffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
userinit.exe0xffe000000xffe0bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x7fefbf700000x7fefbf87fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefc3a00000x7fefc3f5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefdaf00000x7fefdafefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefdc000000x7fefdd66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #38: explorer.exe
+
InformationValue
ID / OS PID#38 / 0x200
OS Parent PID0x10c (c:\windows\system32\userinit.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\explorer.exe
Command LineC:\Windows\Explorer.EXE
MonitorStart Time: 00:01:06, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:22
OS Thread IDs
#402
0x1F8
#403
0x110
#404
0x248
#406
0x298
#407
0x2E8
#408
0x354
#409
0x360
#410
0x388
#411
0x38C
#443
0x46C
#444
0x470
#445
0x474
#446
0x478
#447
0x484
#448
0x488
#449
0x48C
#450
0x490
#451
0x494
#452
0x498
#453
0x4B4
#460
0x4C4
#461
0x4C8
#462
0x4CC
#464
0x4D4
#477
0x50C
#478
0x510
#489
0x544
#502
0x588
#515
0x5B4
#526
0x5D8
#530
0x5E8
#531
0x5EC
#533
0x5F4
#534
0x5F8
#538
0x610
#539
0x614
#542
0x620
#546
0x630
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00021fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00041fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000c00000x000c00000x000c6fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000d00000x000d00000x000d1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000e00000x000e00000x000e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000f00000x000f00000x000f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001000000x001000000x0013ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001400000x001400000x00140fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001500000x001500000x001cffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001d00000x001d00000x001d1fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001e00000x001e00000x001e0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001f00000x001f00000x001f1fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002000000x002000000x00211fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002200000x002200000x00220fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002300000x002300000x00230fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002400000x002400000x00251fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002600000x002600000x00261fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002700000x002700000x00270fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002800000x002800000x0037ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003800000x003800000x0047ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004800000x004800000x0055efffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005600000x005600000x0056ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005700000x005700000x006f7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007000000x007000000x00880fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008900000x008900000x01c8ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001c900000x01c900000x02082fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000020900000x020900000x02090fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000020a00000x020a00000x020a1fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000020b00000x020b00000x020b1fffPagefile Backed MemoryReadableTrueFalseFalse
comctl32.dll.mui0x020c00000x020c2fffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000020d00000x020d00000x020d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020e00000x020e00000x020effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020f00000x020f00000x020f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000021000000x021000000x02108fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000021100000x021100000x02117fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000021200000x021200000x0219ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000021a00000x021a00000x021a0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000021b00000x021b00000x0222ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x022300000x024fefffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000025000000x025000000x025fffffPrivate MemoryReadable, WritableTrueFalseFalse
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db0x025000000x02515fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000025200000x025200000x0259ffffPrivate MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x025a00000x025a3fffMemory Mapped FileReadableTrueFalseFalse
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db0x025b00000x025dffffMemory Mapped FileReadableTrueFalseFalse
cversions.2.db0x025e00000x025e3fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000025f00000x025f00000x025f1fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000026000000x026000000x026b7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000026c00000x026c00000x02839fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000028400000x028400000x0293ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000029400000x029400000x02941fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000029500000x029500000x02953fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029600000x029600000x029dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029e00000x029e00000x02bdffffPrivate MemoryReadable, WritableTrueFalseFalse
thumbcache_32.db0x029e00000x02adffffMemory Mapped FileReadable, WritableTrueTrueFalse
thumbcache_96.db0x02ae00000x02bdffffMemory Mapped FileReadable, WritableTrueTrueFalse
pagefile_0x0000000002be00000x02be00000x02f22fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000002f300000x02f300000x02faffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002f300000x02f300000x02f33fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002f400000x02f400000x02f6ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000002f400000x02f400000x02f40fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000002f500000x02f500000x02f51fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x02f600000x02f63fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x0000000002f700000x02f700000x02f71fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000002f800000x02f800000x02f8ffffPrivate MemoryReadable, WritableTrueFalseFalse
{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db0x02f800000x02f80fffMemory Mapped FileReadableTrueFalseFalse
private_0x0000000002f900000x02f900000x02f90fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002fa00000x02fa00000x02fa0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002fb00000x02fb00000x02fb0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000002fc00000x02fc00000x0303ffffPrivate MemoryReadable, WritableTrueFalseFalse
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db0x030400000x030a5fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000030b00000x030b00000x030b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000030c00000x030c00000x0313ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031400000x031400000x03140fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031500000x031500000x03150fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031600000x031600000x03160fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031700000x031700000x03170fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031800000x031800000x03180fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000031900000x031900000x0320ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000032100000x032100000x03210fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000032200000x032200000x0329ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000032a00000x032a00000x0339ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033a00000x033a00000x033a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033b00000x033b00000x033b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033c00000x033c00000x033c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033d00000x033d00000x033d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033e00000x033e00000x033e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000033f00000x033f00000x033f0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000034000000x034000000x03403fffPrivate MemoryReadable, WritableTrueFalseFalse
thumbcache_1024.db0x034100000x03410fffMemory Mapped FileReadable, WritableTrueFalseFalse
thumbcache_sr.db0x034200000x03420fffMemory Mapped FileReadable, WritableTrueFalseFalse
private_0x00000000034300000x034300000x0347ffffPrivate MemoryReadable, WritableTrueFalseFalse
thumbcache_idx.db0x034800000x03480fffMemory Mapped FileReadable, WritableTrueFalseFalse
private_0x00000000034900000x034900000x0350ffffPrivate MemoryReadable, WritableTrueFalseFalse
StaticCache.dat0x035100000x03e3ffffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x0000000003e400000x03e400000x03e41fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000003e500000x03e500000x03ecffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000003ed00000x03ed00000x03f02fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000003f100000x03f100000x03f8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000003f900000x03f900000x03fd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000003fe00000x03fe00000x0405ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000040600000x040600000x04061fffPrivate MemoryReadable, WritableTrueFalseFalse
thumbcache_1024.db0x040700000x04070fffMemory Mapped FileReadable, WritableTrueFalseFalse
private_0x00000000040800000x040800000x040fffffPrivate MemoryReadable, WritableTrueFalseFalse
thumbcache_sr.db0x041000000x04100fffMemory Mapped FileReadable, WritableTrueFalseFalse
thumbcache_idx.db0x041100000x04110fffMemory Mapped FileReadable, WritableTrueFalseFalse
pagefile_0x00000000041200000x041200000x04120fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000041300000x041300000x041affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000041b00000x041b00000x0422ffffPrivate MemoryReadable, WritableTrueFalseFalse
TranscodedWallpaper.jpg0x041b00000x0424cfffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000041b00000x041b00000x0422ffffPrivate MemoryReadable, WritableTrueFalseFalse
thumbcache_32.db0x042300000x0432ffffMemory Mapped FileReadable, WritableTrueFalseFalse
private_0x00000000042500000x042500000x042cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000042900000x042900000x0430ffffPrivate MemoryReadable, WritableTrueFalseFalse
wdmaud.drv.mui0x043300000x04330fffMemory Mapped FileReadable, WritableFalseFalseFalse
MMDevAPI.dll.mui0x043400000x04340fffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000043500000x043500000x04351fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000043600000x043600000x04361fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000043700000x043700000x04371fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x043800000x04383fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000043900000x043900000x0440ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000044100000x044100000x04410fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000044200000x044200000x0449ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000044a00000x044a00000x044a1fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000044b00000x044b00000x044b1fffPagefile Backed MemoryReadableTrueFalseFalse
thumbcache_1024.db0x044c00000x044c0fffMemory Mapped FileReadable, WritableTrueTrueFalse
thumbcache_sr.db0x044d00000x044d0fffMemory Mapped FileReadable, WritableTrueTrueFalse
thumbcache_idx.db0x044e00000x044e0fffMemory Mapped FileReadable, WritableTrueTrueFalse
pagefile_0x00000000044f00000x044f00000x044f1fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000045000000x045000000x0457ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000045800000x045800000x04581fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000045d00000x045d00000x045d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000045f00000x045f00000x0466ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000046700000x046700000x0486ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000048700000x048700000x04f07fffPrivate MemoryReadable, WritableTrueFalseFalse
thumbcache_96.db0x048700000x0496ffffMemory Mapped FileReadable, WritableTrueFalseFalse
thumbcache_256.db0x049700000x04a6ffffMemory Mapped FileReadable, WritableTrueFalseFalse
private_0x0000000004a700000x04a700000x04aeffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004b100000x04b100000x04b8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000004b900000x04b900000x04f92fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000050000000x050000000x0507ffffPrivate MemoryReadable, WritableTrueFalseFalse
thumbcache_32.db0x050800000x0517ffffMemory Mapped FileReadable, WritableTrueFalseFalse
thumbcache_96.db0x051800000x0527ffffMemory Mapped FileReadable, WritableTrueFalseFalse
thumbcache_256.db0x052800000x0537ffffMemory Mapped FileReadable, WritableTrueFalseFalse
imageres.dll0x053800000x066d4fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000066e00000x066e00000x0675ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000067600000x067600000x067dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000067e00000x067e00000x068dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000068400000x068400000x068bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000069100000x069100000x0698ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000069900000x069900000x0699ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006a200000x06a200000x06a2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006ac00000x06ac00000x06b3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006b700000x06b700000x06beffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006bf00000x06bf00000x06c6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006cc00000x06cc00000x06d3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006d400000x06d400000x06e40fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006d700000x06d700000x06deffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006d900000x06d900000x06e0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006e600000x06e600000x06e6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000006f100000x06f100000x06f8ffffPrivate MemoryReadable, WritableTrueFalseFalse
KernelBase.dll.mui0x06f900000x0704ffffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000070500000x070500000x070cffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000071000000x071000000x0717ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000071e00000x071e00000x0725ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000072600000x072600000x0765ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000076600000x076600000x0795ffffPrivate MemoryReadable, WritableTrueFalseFalse
ksuser.dll0x73f700000x73f75fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imageres.dll0x744c00000x75815fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FXSRESM.dll0x74ff00000x750d2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
psapi.dll0x77cc00000x77cc6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
explorer.exe0xff0800000xff33ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleacc.dll0x7fef84c00000x7fef8513fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ieframe.dll0x7fef85200000x7fef90d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
webcheck.dll0x7fef90e00000x7fef9129fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FXSAPI.dll0x7fef91300000x7fef91ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FXSST.dll0x7fef91d00000x7fef92a6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ActionCenter.dll0x7fef92b00000x7fef9371fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srchadmin.dll0x7fef93800000x7fef93d7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
webio.dll0x7fef93e00000x7fef9443fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winhttp.dll0x7fef94500000x7fef94c0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ncsi.dll0x7fef94d00000x7fef9507fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mlang.dll0x7fef94d00000x7fef950afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cscobj.dll0x7fef95100000x7fef954efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
QUTIL.DLL0x7fef95500000x7fef956efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pnidui.dll0x7fef95700000x7fef972cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
PortableDeviceApi.dll0x7fef97300000x7fef97ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
PortableDeviceTypes.dll0x7fef97f00000x7fef9828fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WPDShServiceObj.dll0x7fef98300000x7fef984ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
AltTab.dll0x7fef98500000x7fef985ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netshell.dll0x7fef98d00000x7fef9b5afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ehSSO.dll0x7fef9b600000x7fef9b6afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
DXP.dll0x7fef9b700000x7fef9be3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winspool.drv0x7fef9fa00000x7fefa010fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
networkexplorer.dll0x7fefa1400000x7fefa2dbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
thumbcache.dll0x7fefa2e00000x7fefa2fefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
tiptsf.dll0x7fefa4400000x7fefa4befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msls31.dll0x7fefa4c00000x7fefa4fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msftedit.dll0x7fefa5000000x7fefa5c5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wer.dll0x7fefa5d00000x7fefa64bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gameux.dll0x7fefa6500000x7fefa8f2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
linkinfo.dll0x7fefa9000000x7fefa90bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shdocvw.dll0x7fefa9100000x7fefa943fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
actxprxy.dll0x7fefa9500000x7fefaa3dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc.dll0x7fefab200000x7fefab37fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc6.dll0x7fefab400000x7fefab50fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FWPUCLNT.DLL0x7fefab700000x7fefabc2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
timedate.cpl0x7fefb0000000x7fefb082fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IconCodecService.dll0x7fefb0900000x7fefb097fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntshrui.dll0x7fefb0a00000x7fefb11ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cscapi.dll0x7fefb1200000x7fefb12efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cscdll.dll0x7fefb1300000x7fefb13bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cscui.dll0x7fefb1400000x7fefb1bdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
EhStorShell.dll0x7fefb1c00000x7fefb1f4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apphelp.dll0x7fefb2000000x7fefb256fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ExplorerFrame.dll0x7fefb2600000x7fefb429fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wdmaud.drv0x7fefb4900000x7fefb4cafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winmm.dll0x7fefb4d00000x7fefb50afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x7fefb5100000x7fefb51afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x7fefb5200000x7fefb546fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
es.dll0x7fefb5800000x7fefb5e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x7fefb5f00000x7fefb5fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
taskschd.dll0x7fefb6600000x7fefb786fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
atl.dll0x7fefb7900000x7fefb7a8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nlaapi.dll0x7fefb7f00000x7fefb804fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x7fefb9c00000x7fefb9ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
avrt.dll0x7fefba100000x7fefba18fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x7fefba200000x7fefba4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Syncreg.dll0x7fefbb000000x7fefbb15fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
prnfldr.dll0x7fefbb200000x7fefbb88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
batmeter.dll0x7fefbb900000x7fefbc49fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samcli.dll0x7fefbc500000x7fefbc63fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x7fefbc900000x7fefbc9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
midimap.dll0x7fefbd000000x7fefbd08fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msacm32.dll0x7fefbd100000x7fefbd27fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
stobject.dll0x7fefbd300000x7fefbd72fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
AudioSes.dll0x7fefbd800000x7fefbdcefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wtsapi32.dll0x7fefbdd00000x7fefbde0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msacm32.drv0x7fefbdf00000x7fefbdf9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WindowsCodecs.dll0x7fefbe000000x7fefbf29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
xmllite.dll0x7fefbf300000x7fefbf64fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x7fefbf700000x7fefbf87fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
MMDevAPI.dll0x7fefbf900000x7fefbfdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
hid.dll0x7fefbfe00000x7fefbfeafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
SndVolSSO.dll0x7fefbff00000x7fefc02afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
duser.dll0x7fefc0300000x7fefc072fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dui70.dll0x7fefc0800000x7fefc171fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
GdiPlus.dll0x7fefc1800000x7fefc394fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefc3a00000x7fefc3f5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x7fefc4000000x7fefc52bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samlib.dll0x7fefc5300000x7fefc54cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shacct.dll0x7fefc5500000x7fefc573fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x7fefc5800000x7fefc773fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptui.dll0x7fefc7800000x7fefc888fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
authui.dll0x7fefc8900000x7fefca69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x7fefcc100000x7fefcc1bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wevtapi.dll0x7fefd5500000x7fefd5bcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x7fefd8100000x7fefd832fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefdaf00000x7fefdafefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wintrust.dll0x7fefdb000000x7fefdb39fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x7fefdb400000x7fefdb59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefdc000000x7fefdd66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x7fefde300000x7fefe088fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x7fefe1700000x7fefe346fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x7fefe6500000x7fefe779fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefe8600000x7fefe8d0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x7fefec200000x7fefec71fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x7fefed900000x7fefef07fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x7feff0800000x7feffe07fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffff820000x7fffff820000x7fffff83fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff840000x7fffff840000x7fffff85fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff860000x7fffff860000x7fffff87fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff880000x7fffff880000x7fffff89fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff8a0000x7fffff8a0000x7fffff8bfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff8c0000x7fffff8c0000x7fffff8dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff8e0000x7fffff8e0000x7fffff8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff900000x7fffff900000x7fffff91fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff900000x7fffff900000x7fffff91fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff920000x7fffff920000x7fffff93fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff940000x7fffff940000x7fffff95fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff960000x7fffff960000x7fffff97fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff980000x7fffff980000x7fffff99fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9a0000x7fffff9a0000x7fffff9bfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9c0000x7fffff9c0000x7fffff9dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9e0000x7fffff9e0000x7fffff9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa00000x7fffffa00000x7fffffa1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa20000x7fffffa20000x7fffffa3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa40000x7fffffa40000x7fffffa5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa60000x7fffffa60000x7fffffa7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd40000x7fffffd40000x7fffffd5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd60000x7fffffd60000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #39: dwm.exe
+
InformationValue
ID / OS PID#39 / 0x104
OS Parent PID0x32c (c:\windows\system32\svchost.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\dwm.exe
Command Line"C:\Windows\system32\Dwm.exe"
MonitorStart Time: 00:01:07, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:21
OS Thread IDs
#415
0x134
#417
0x404
#419
0x408
#420
0x410
#422
0x414
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00041fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000500000x000b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000c00000x000c00000x000c1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000d00000x000d00000x000d0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000e00000x000e00000x000e0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001a00000x001a00000x001affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001d00000x001d00000x0024ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002500000x002500000x0034ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003800000x003800000x0047ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004800000x004800000x00607fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006100000x006100000x00790fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007a00000x007a00000x01b9ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001ba00000x01ba00000x01f92fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000021600000x021600000x021dffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
psapi.dll0x77cc00000x77cc6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
dwm.exe0xff6200000xff642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dxgi.dll0x7fefacd00000x7fefad76fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
d3d10_1core.dll0x7fefad800000x7fefadd4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
d3d10_1.dll0x7fefade00000x7fefae13fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmcore.dll0x7fefae200000x7fefafb1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmredir.dll0x7fefafc00000x7fefafe6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WindowsCodecs.dll0x7fefbe000000x7fefbf29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x7fefbf700000x7fefbf87fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefc3a00000x7fefc3f5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x7fefcc100000x7fefcc1bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #40: svchost.exe
+
InformationValue
ID / OS PID#40 / 0x41c
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\svchost.exe
Command LineC:\Windows\system32\svchost.exe -k NetworkService
MonitorStart Time: 00:01:08, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:20
OS Thread IDs
#424
0x420
#425
0x424
#428
0x430
#430
0x438
#431
0x43C
#432
0x440
#435
0x44C
#436
0x450
#437
0x454
#438
0x458
#439
0x45C
#441
0x464
#455
0x480
#479
0x514
#566
0x680
#574
0x6A0
#577
0x6AC
#578
0x6B4
#580
0x6BC
#585
0x6D0
#591
0x6E8
#598
0x704
#599
0x708
#600
0x70C
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x000affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000b00000x000b00000x000b3fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000c00000x000c00000x000c0fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000d00000x00136fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001400000x001400000x0023ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002400000x002400000x00241fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000002500000x002500000x00250fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002600000x002600000x00260fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002700000x002700000x0036ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003700000x003700000x0042ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000004300000x004300000x004affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004b00000x004b00000x004bffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004c00000x004c00000x00647fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006500000x006500000x007d0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007e00000x007e00000x00bd2fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000be00000x00be00000x00be0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000bf00000x00bf00000x00bf0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000c000000x00c000000x00c00fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000c100000x00c100000x00c8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ce00000x00ce00000x00d5ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d900000x00d900000x00e0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000eb00000x00eb00000x00f2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000f400000x00f400000x00fbffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000010000000x010000000x0107ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x010800000x0134efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000013500000x013500000x0144ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014600000x014600000x014dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015400000x015400000x015bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016300000x016300000x016affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016b00000x016b00000x0172ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017300000x017300000x017affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017e00000x017e00000x0185ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000018700000x018700000x018effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019400000x019400000x0194ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019c00000x019c00000x01a3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001a400000x01a400000x01abffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001ac00000x01ac00000x01bbffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001af00000x01af00000x01b6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001bc00000x01bc00000x01bcffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001c000000x01c000000x01c0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001c300000x01c300000x01caffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001cb00000x01cb00000x01daffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
svchost.exe0xffa200000xffa2afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ssdpapi.dll0x7fef8a400000x7fef8a50fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ncsi.dll0x7fef8a600000x7fef8a97fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nlasvc.dll0x7fef8aa00000x7fef8aedfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
vsstrace.dll0x7fef8b000000x7fef8b16fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
vssapi.dll0x7fef8b200000x7fef8ccffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsvc.dll0x7fef8d000000x7fef8d2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkssvc.dll0x7fef8d300000x7fef8d4ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
webio.dll0x7fef93e00000x7fef9443fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winhttp.dll0x7fef94500000x7fef94c0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc.dll0x7fefab200000x7fefab37fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc6.dll0x7fefab400000x7fefab50fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsext.dll0x7fefab600000x7fefab66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FWPUCLNT.DLL0x7fefab700000x7fefabc2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsrslvr.dll0x7fefabd00000x7fefabfffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x7fefb5100000x7fefb51afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x7fefb5200000x7fefb546fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
es.dll0x7fefb5800000x7fefb5e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
atl.dll0x7fefb7900000x7fefb7a8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samcli.dll0x7fefbc500000x7fefbc63fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x7fefbc900000x7fefbc9bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x7fefc4000000x7fefc52bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
samlib.dll0x7fefc5300000x7fefc54cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WSHTCPIP.DLL0x7fefcce00000x7fefcce6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gpapi.dll0x7fefcde00000x7fefcdfafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsapi.dll0x7fefd1600000x7fefd1bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wship6.dll0x7fefd2d00000x7fefd2d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x7fefd2e00000x7fefd334fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netjoin.dll0x7fefd4500000x7fefd481fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wevtapi.dll0x7fefd5500000x7fefd5bcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x7fefdaf00000x7fefdafefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x7fefdc000000x7fefdd66fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffffa00000x7fffffa00000x7fffffa1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa20000x7fffffa20000x7fffffa3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa40000x7fffffa40000x7fffffa5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa60000x7fffffa60000x7fffffa7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdcfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #41: esentutl.exe
(Host: 179, Network: 0)
+
InformationValue
ID / OS PID#41 / 0x49c
OS Parent PID0x200 (c:\windows\explorer.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe
Command Line"C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"
MonitorStart Time: 00:01:10, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:18
OS Thread IDs
#456
0x4A0
#476
0x508
#522
0x5CC
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x0003ffffPrivate MemoryReadable, WritableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000000500000x000500000x0008ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000900000x000900000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001900000x001900000x00193fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001a00000x001a00000x001a0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001b00000x001b00000x0022ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002300000x002300000x00230fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000002400000x002400000x0033ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x003400000x003a6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000003b00000x003b00000x003c5fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000003d00000x003d00000x003ecfffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
pagefile_0x00000000003f00000x003f00000x003f6fffPagefile Backed MemoryReadableTrueFalseFalse
esentutl.exe0x004000000x0042afffMemory Mapped FileReadable, Writable, ExecutableTrueTrueFalse
pagefile_0x00000000004300000x004300000x005b7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005c00000x005c00000x00740fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007500000x007500000x01b4ffffPagefile Backed MemoryReadableTrueFalseFalse
C_1251.NLS0x01b500000x01b60fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x0000000001b700000x01b700000x01b71fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x0000000001b800000x01b800000x01bbffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000001bc00000x01bc00000x01c9efffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001ca00000x01ca00000x01cdffffPrivate MemoryReadable, WritableTrueFalseFalse
AdapterTroubleshooter.exe0x01ce00000x01ce9fffMemory Mapped FileReadableFalseFalseFalse
AdapterTroubleshooter.exe0x01ce00000x01ce9fffMemory Mapped FileReadableFalseFalseFalse
private_0x0000000001cf00000x01cf00000x01d2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d300000x01d300000x01d6ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d700000x01d700000x01d7ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d800000x01d800000x01e7ffffPrivate MemoryReadable, WritableTrueFalseFalse
kernel32.dll.mui0x01e800000x01f3ffffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x0000000001f500000x01f500000x01f8ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f900000x01f900000x0208ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x020900000x0235efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000023600000x023600000x0245ffffPrivate MemoryReadable, WritableTrueFalseFalse
samcli.dll0x73f800000x73f8efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x73f900000x73f9efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x73fa00000x73fb8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x73fc00000x73fc8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netapi32.dll0x73fd00000x73fe0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mpr.dll0x73ff00000x74001fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x740100000x74018fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winspool.drv0x741500000x741a0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x743500000x743cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x743d00000x7440bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x744100000x74417fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x744200000x7447bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x744800000x744befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x758000000x75812fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x758300000x7583bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x758400000x7589ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x758a00000x758fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x759000000x75a0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x75a100000x75b6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x75b700000x75c0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x75c200000x75c54fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x75c600000x75c69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x75c700000x75da5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x75dc00000x75dcbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x75dd00000x75e26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x75e300000x75f2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x75f300000x76024fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x760300000x760ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x761500000x761dffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x761e00000x76e29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imagehlp.dll0x76ec00000x76ee9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x76ef00000x76f7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76f800000x7704bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x770500000x7713ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x771f00000x77235fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x772400000x772ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x772f00000x7740cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x774100000x77428fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x775400000x7773afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000778e00000x778e00000x779d9fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000779e00000x779e00000x77afefffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x77cb00000x77cb5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77ce00000x77e5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Threads
Thread 0x4a0
(Host: 178, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75900000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualProtect, address = 0x7591435fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\user32.dll, base_address = 0x75e30000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IMPGetIMEA, address = 0x75ea7331True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetForegroundWindow, address = 0x75e6f170True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = ShowWindow, address = 0x75e50dfbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSysColor, address = 0x75e46c3cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetKeyboardLayoutNameA, address = 0x75ea6bd9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IsWindow, address = 0x75e47136True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSystemMetrics, address = 0x75e47d2fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetWindowPos, address = 0x75e48e4eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetFocus, address = 0x75e50deeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetMenuInfo, address = 0x75e9d222True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = DispatchMessageA, address = 0x75e47bbbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = InvalidateRect, address = 0x75e51381True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\mswsock.dll, base_address = 0x743d0000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSPStartup, address = 0x743d8a9bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = dn_expand, address = 0x743eb97cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = sethostname, address = 0x743e6582True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = MigrateWinsockConfiguration, address = 0x743dcd27True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = NPLoadNameSpaces, address = 0x743f1a3eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetNameByTypeA, address = 0x743ee59fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = TransmitFile, address = 0x743ec7e2True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = inet_network, address = 0x743e6597True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAddressByNameA, address = 0x743eddb5True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAcceptExSockaddrs, address = 0x743ec9daTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameW, address = 0x743edfd7True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSARecvEx, address = 0x743f1b55True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetServiceW, address = 0x743ef340True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceA, address = 0x743eefaeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsW, address = 0x743ecc25True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameA, address = 0x743ee260True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceW, address = 0x743ef118True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StartWsdpService, address = 0x743e633dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsA, address = 0x743ed368True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = rexec, address = 0x743e656dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StopWsdpService, address = 0x743e5e56True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75900000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address = 0x75911450True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = InterlockedDecrement, address = 0x759113f0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapCreate, address = 0x75914a2dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetThreadLocale, address = 0x759135cfTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address = 0x75911725True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenW, address = 0x75911700True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FileTimeToSystemTime, address = 0x7591542cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address = 0x7593772fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address = 0x759187c9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount, address = 0x7591110cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address = 0x75911946True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleAliasesA, address = 0x759b6680True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenA, address = 0x75915a4bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiA, address = 0x75913e8eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address = 0x7592d802True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsA, address = 0x7591e349True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address = 0x759151cbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address = 0x77d21f6eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetFileAttributesW, address = 0x75911b18True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address = 0x75915189True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address = 0x75911809True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringA, address = 0x7593bc39True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address = 0x7593d1a1True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address = 0x759134b0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address = 0x759151e3True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address = 0x75913509True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualAlloc, address = 0x75911856True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address = 0x759111f8True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address = 0x7591170dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address = 0x759117b9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetHandleCount, address = 0x7591cb29True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeA, address = 0x75938266True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiW, address = 0x7592d5cdTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStrings, address = 0x7591e361True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTime, address = 0x75915a96True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address = 0x7599454fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GlobalSize, address = 0x7592d16fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\gdi32.dll, base_address = 0x76150000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICW, address = 0x7616c040True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICA, address = 0x76167c2eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = GetCharWidth32W, address = 0x7616c93cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = DeleteObject, address = 0x76165689True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreatePen, address = 0x7616ba4fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateRectRgnIndirect, address = 0x7616a764True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateDCA, address = 0x76167bccTrue1
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False10
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODLOADmodule_name = CRYPT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WININET.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHLWAPI.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = VERSION.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = MPR.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = imagehlp.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WS2_32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = KERNEL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ADVAPI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = USER32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ole32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHELL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ntdll.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = OLEAUT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = GDI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = NETAPI32.dll, base_address = 0x0True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_02False1
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86)True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86), data_ident_out = 67True1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDirTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir, data_ident_out = 67True1
Fn
FILECREATEfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x49c, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x1d30000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x49c, base_address = 0x1d30000True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00, data_ident_out = 154True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01, data_ident_out = 103True1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
MUTEXOPENmutex_name = shell.{0835FA03-68AC-09B6-0CE4-703246A746AB}, desired_access = SYNCHRONIZEFalse1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, value_name = EnableLUA, data_ident_out = 1True1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
MODLOADmodule_name = shell32.dll, base_address = 0x761e0000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\shell32.dll, function = SHCreateItemFromParsingName, address = 0x76234215True1
Fn
MODLOADmodule_name = C:\Windows\SysWOW64\AdapterTroubleshooter.exe, base_address = 0x1ce0001True1
Fn
FILECREATEfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x49c, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x1ce0000True1
Fn
FILECREATE_TMPFILEfile_name = c:\users\hjrd1k~1\appdata\local\temp\8055.tmp, path = C:\Users\HJRD1K~1\AppData\Local\Temp\True1
Fn
FILECOPYdestination_file_name = c:\users\hjrd1k~1\appdata\local\temp\8055.tmp, source_file_name = c:\windows\syswow64\d3d9.dll, fail_if_exists = 0True1
Fn
FILECREATEfile_name = c:\users\hjrd1k~1\appdata\local\temp\8055.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1k~1\appdata\local\temp\8055.tmp, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1k~1\appdata\local\temp\8055.tmp, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x49c, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x2460000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x49c, base_address = 0x2460000True1
Fn
FILECREATEfile_name = c:\users\hjrd1k~1\appdata\local\temp\8055.tmp, desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYSTrue1
Fn
FILEWRITEfile_name = c:\users\hjrd1k~1\appdata\local\temp\8055.tmp, size = 1832448True1
Fn
PROCCREATEprocess_name = "C:\Windows\SysWOW64\explorer.exe", os_tid = 0x60c, os_pid = 0x608, creation_flags = CREATE_SUSPENDED, CREATE_DETACHED_PROCESS, CREATE_BREAKAWAY_FROM_JOB, CREATE_NO_WINDOW, show_window = SW_HIDETrue1
Fn
PROCGET_INFOprocess_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x608True1
Fn
MEMREADaddress = 0x7efde000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x608, size = 584True1
Fn
Data
MEMREADaddress = 0x440000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x608, size = 1024True1
Fn
Data
MEMALLOCaddress = 0x70000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x608, size = 135136, allocation_type = MEM_COMMIT, protection = PAGE_EXECUTE_READWRITETrue1
Fn
MEMWRITEaddress = 0x70000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x608, size = 131072True1
Fn
Data
MEMWRITEaddress = 0x90000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x608, size = 4064True1
Fn
Data
MEMWRITEaddress = 0x470efa, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x608, size = 14True1
Fn
Data
THREADRESUMEprocess_name = c:\windows\system32\svchost.exe, os_tid = 0x60c, os_pid = 0x35cTrue1
Fn
Thread 0x5cc
(Host: 1, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
WNDCREATEclass_name = hGHAEnFbRS~aFtQb(dlj*XoUlxI>K$xU@[V}Dlk^YrX u8bqG^A6[hb*AR=#(DJ{B@V6~<>Uf+6R4)l{@Hg3_*c6)uviZ j2mf N<LwxP7ctYMI[$p9x<N5k9]oG$*j=&+=jY&wMxCBg+D[L1z+i_d*NMf1GVIR)PtHp&gjb&]@T-ZJS9rTMvFxe4s*YSA&PV{&g_sQECmoxy$5K+yD6CG~M7<X6xokm@3[%oipsvO+5rt28<Xv=)gnPp6mwG70, x_coordinate = 1, y_coordinate = 1, width = 1, height = 1, window_parameter = 0True1
Fn
Process #42: runonce.exe
+
InformationValue
ID / OS PID#42 / 0x4a4
OS Parent PID0x200 (c:\windows\explorer.exe)
Initial Working DirectoryC:\Windows\SysWOW64
File Namec:\windows\syswow64\runonce.exe
Command LineC:\Windows\SysWOW64\runonce.exe /Run6432
MonitorStart Time: 00:01:10, Reason: Child Process
UnmonitorEnd Time: 00:01:16, Reason: Terminated
Monitor Duration00:00:06
OS Thread IDs
#457
0x4A8
#468
0x4DC
#469
0x4E4
#472
0x4FC
#496
0x564
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00031fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000000500000x000500000x00053fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00061fffPagefile Backed MemoryReadableTrueFalseFalse
runonce.exe.mui0x000700000x00070fffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000000800000x000800000x00080fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000900000x000900000x000cffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x000d00000x00136fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001400000x001400000x00140fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001500000x001500000x00150fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001600000x001600000x00161fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001700000x001700000x001a3fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001b00000x001b00000x001b1fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001c00000x001c00000x001c0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001d00000x001d00000x0020ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002100000x002100000x00210fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x002200000x00223fffMemory Mapped FileReadableTrueFalseFalse
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db0x002300000x00245fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000002500000x002500000x0028ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002900000x002900000x002cffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002d00000x002d00000x002d0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x002e00000x002e3fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000003000000x003000000x0037ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003800000x003800000x003bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003d00000x003d00000x0040ffffPrivate MemoryReadable, WritableTrueFalseFalse
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db0x004100000x0043ffffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000004700000x004700000x0056ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000005700000x005700000x0064efffPagefile Backed MemoryReadableTrueFalseFalse
runonce.exe0x006800000x0068efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000006900000x006900000x00817fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000008500000x008500000x0085ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000008600000x008600000x009e0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000009f00000x009f00000x01deffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001e400000x01e400000x01e7ffffPrivate MemoryReadable, WritableTrueFalseFalse
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db0x01e800000x01ee5fffMemory Mapped FileReadableTrueFalseFalse
private_0x0000000001f000000x01f000000x01f3ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x01f400000x0220efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000022100000x022100000x0224ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000022500000x022500000x02642fffPagefile Backed MemoryReadableTrueFalseFalse
profapi.dll0x73f600000x73f6afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x740200000x74040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x740500000x74144fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x741b00000x7434dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x743500000x743cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x744100000x74417fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x744200000x7447bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x744800000x744befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x758300000x7583bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x758400000x7589ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x758a00000x758fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x759000000x75a0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x75a100000x75b6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x75b700000x75c0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x75c600000x75c69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x75c700000x75da5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x75dc00000x75dcbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x75dd00000x75e26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x75e300000x75f2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x75f300000x76024fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x760300000x760ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x760d00000x760e1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x761500000x761dffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x761e00000x76e29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x76ef00000x76f7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76f800000x7704bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x770500000x7713ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x771c00000x771e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x771f00000x77235fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x772400000x772ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x772f00000x7740cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x774100000x77428fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x774600000x774e2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x774f00000x77534fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x775400000x7773afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x777400000x778dcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000778e00000x778e00000x779d9fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000779e00000x779e00000x77afefffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77ce00000x77e5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Process #43: esentutl.exe
(Host: 179, Network: 0)
+
InformationValue
ID / OS PID#43 / 0x4ac
OS Parent PID0x200 (c:\windows\explorer.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}
File Namec:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe
Command Line"C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"
MonitorStart Time: 00:01:10, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:18
OS Thread IDs
#458
0x4B0
#474
0x504
#553
0x648
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00030fffPrivate MemoryReadable, WritableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000000500000x000500000x0008ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000900000x000900000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001900000x001900000x00193fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x001a00000x00206fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000002100000x002100000x0028ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002900000x002900000x002a5fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000002b00000x002b00000x002ccfffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
pagefile_0x00000000002d00000x002d00000x002d0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000002e00000x002e00000x002effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002f00000x002f00000x002f6fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000003000000x003000000x003fffffPrivate MemoryReadable, WritableTrueFalseFalse
esentutl.exe0x004000000x0042afffMemory Mapped FileReadable, Writable, ExecutableTrueTrueFalse
pagefile_0x00000000004300000x004300000x005b7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005c00000x005c00000x00740fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007500000x007500000x01b4ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001b500000x01b500000x01c2efffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001c300000x01c300000x01c6ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000001c700000x01c700000x01c71fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x0000000001c800000x01c800000x01cbffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001cc00000x01cc00000x01dbffffPrivate MemoryReadable, WritableTrueFalseFalse
C_1251.NLS0x01dc00000x01dd0fffMemory Mapped FileReadableFalseFalseFalse
AdapterTroubleshooter.exe0x01de00000x01de9fffMemory Mapped FileReadableFalseFalseFalse
private_0x0000000001e000000x01e000000x01e0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e200000x01e200000x01e5ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e600000x01e600000x01e9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f400000x01f400000x01f7ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001f800000x01f800000x0207ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x020800000x0234efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000023500000x023500000x0244ffffPrivate MemoryReadable, WritableTrueFalseFalse
kernel32.dll.mui0x024500000x0250ffffMemory Mapped FileReadable, WritableFalseFalseFalse
samcli.dll0x73f800000x73f8efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x73f900000x73f9efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x73fa00000x73fb8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x73fc00000x73fc8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netapi32.dll0x73fd00000x73fe0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mpr.dll0x73ff00000x74001fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x740100000x74018fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winspool.drv0x741500000x741a0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x743500000x743cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x743d00000x7440bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x744100000x74417fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x744200000x7447bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x744800000x744befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x758000000x75812fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x758300000x7583bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x758400000x7589ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x758a00000x758fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x759000000x75a0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x75a100000x75b6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x75b700000x75c0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x75c200000x75c54fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x75c600000x75c69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x75c700000x75da5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x75dc00000x75dcbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x75dd00000x75e26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x75e300000x75f2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x75f300000x76024fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x760300000x760ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x761500000x761dffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x761e00000x76e29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imagehlp.dll0x76ec00000x76ee9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x76ef00000x76f7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76f800000x7704bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x770500000x7713ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x771f00000x77235fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x772400000x772ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x772f00000x7740cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x774100000x77428fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x775400000x7773afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000778e00000x778e00000x779d9fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000779e00000x779e00000x77afefffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x77cb00000x77cb5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77ce00000x77e5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Threads
Thread 0x4b0
(Host: 178, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75900000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualProtect, address = 0x7591435fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\user32.dll, base_address = 0x75e30000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IMPGetIMEA, address = 0x75ea7331True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetForegroundWindow, address = 0x75e6f170True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = ShowWindow, address = 0x75e50dfbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSysColor, address = 0x75e46c3cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetKeyboardLayoutNameA, address = 0x75ea6bd9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IsWindow, address = 0x75e47136True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSystemMetrics, address = 0x75e47d2fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetWindowPos, address = 0x75e48e4eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetFocus, address = 0x75e50deeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetMenuInfo, address = 0x75e9d222True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = DispatchMessageA, address = 0x75e47bbbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = InvalidateRect, address = 0x75e51381True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\mswsock.dll, base_address = 0x743d0000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSPStartup, address = 0x743d8a9bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = dn_expand, address = 0x743eb97cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = sethostname, address = 0x743e6582True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = MigrateWinsockConfiguration, address = 0x743dcd27True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = NPLoadNameSpaces, address = 0x743f1a3eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetNameByTypeA, address = 0x743ee59fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = TransmitFile, address = 0x743ec7e2True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = inet_network, address = 0x743e6597True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAddressByNameA, address = 0x743eddb5True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAcceptExSockaddrs, address = 0x743ec9daTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameW, address = 0x743edfd7True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSARecvEx, address = 0x743f1b55True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetServiceW, address = 0x743ef340True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceA, address = 0x743eefaeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsW, address = 0x743ecc25True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameA, address = 0x743ee260True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceW, address = 0x743ef118True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StartWsdpService, address = 0x743e633dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsA, address = 0x743ed368True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = rexec, address = 0x743e656dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StopWsdpService, address = 0x743e5e56True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75900000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address = 0x75911450True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = InterlockedDecrement, address = 0x759113f0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapCreate, address = 0x75914a2dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetThreadLocale, address = 0x759135cfTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address = 0x75911725True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenW, address = 0x75911700True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FileTimeToSystemTime, address = 0x7591542cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address = 0x7593772fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address = 0x759187c9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount, address = 0x7591110cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address = 0x75911946True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleAliasesA, address = 0x759b6680True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenA, address = 0x75915a4bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiA, address = 0x75913e8eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address = 0x7592d802True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsA, address = 0x7591e349True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address = 0x759151cbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address = 0x77d21f6eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetFileAttributesW, address = 0x75911b18True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address = 0x75915189True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address = 0x75911809True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringA, address = 0x7593bc39True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address = 0x7593d1a1True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address = 0x759134b0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address = 0x759151e3True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address = 0x75913509True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualAlloc, address = 0x75911856True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address = 0x759111f8True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address = 0x7591170dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address = 0x759117b9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetHandleCount, address = 0x7591cb29True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeA, address = 0x75938266True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiW, address = 0x7592d5cdTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStrings, address = 0x7591e361True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTime, address = 0x75915a96True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address = 0x7599454fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GlobalSize, address = 0x7592d16fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\gdi32.dll, base_address = 0x76150000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICW, address = 0x7616c040True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICA, address = 0x76167c2eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = GetCharWidth32W, address = 0x7616c93cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = DeleteObject, address = 0x76165689True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreatePen, address = 0x7616ba4fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateRectRgnIndirect, address = 0x7616a764True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateDCA, address = 0x76167bccTrue1
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False10
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODLOADmodule_name = CRYPT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WININET.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHLWAPI.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = VERSION.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = MPR.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = imagehlp.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WS2_32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = KERNEL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ADVAPI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = USER32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ole32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHELL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ntdll.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = OLEAUT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = GDI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = NETAPI32.dll, base_address = 0x0True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_02False1
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86)True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86), data_ident_out = 67True1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDirTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir, data_ident_out = 67True1
Fn
FILECREATEfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4ac, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x1de0000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4ac, base_address = 0x1de0000True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00, data_ident_out = 154True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01, data_ident_out = 103True1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
MUTEXOPENmutex_name = shell.{0835FA03-68AC-09B6-0CE4-703246A746AB}, desired_access = SYNCHRONIZEFalse1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, value_name = EnableLUA, data_ident_out = 1True1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
MODLOADmodule_name = shell32.dll, base_address = 0x761e0000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\shell32.dll, function = SHCreateItemFromParsingName, address = 0x76234215True1
Fn
MODLOADmodule_name = C:\Windows\SysWOW64\AdapterTroubleshooter.exe, base_address = 0x1de0001True1
Fn
FILECREATEfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4ac, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x1de0000True1
Fn
FILECREATE_TMPFILEfile_name = c:\users\hjrd1k~1\appdata\local\temp\90d9.tmp, path = C:\Users\HJRD1K~1\AppData\Local\Temp\True1
Fn
FILECOPYdestination_file_name = c:\users\hjrd1k~1\appdata\local\temp\90d9.tmp, source_file_name = c:\windows\syswow64\d3d9.dll, fail_if_exists = 0True1
Fn
FILECREATEfile_name = c:\users\hjrd1k~1\appdata\local\temp\90d9.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1k~1\appdata\local\temp\90d9.tmp, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1k~1\appdata\local\temp\90d9.tmp, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4ac, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x2510000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4ac, base_address = 0x2510000True1
Fn
FILECREATEfile_name = c:\users\hjrd1k~1\appdata\local\temp\90d9.tmp, desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYSTrue1
Fn
FILEWRITEfile_name = c:\users\hjrd1k~1\appdata\local\temp\90d9.tmp, size = 1832448True1
Fn
PROCCREATEprocess_name = "C:\Windows\SysWOW64\explorer.exe", os_tid = 0x668, os_pid = 0x664, creation_flags = CREATE_SUSPENDED, CREATE_DETACHED_PROCESS, CREATE_BREAKAWAY_FROM_JOB, CREATE_NO_WINDOW, show_window = SW_HIDETrue1
Fn
PROCGET_INFOprocess_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x664True1
Fn
MEMREADaddress = 0x7efde000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x664, size = 584True1
Fn
Data
MEMREADaddress = 0x440000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x664, size = 1024True1
Fn
Data
MEMALLOCaddress = 0x70000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x664, size = 135136, allocation_type = MEM_COMMIT, protection = PAGE_EXECUTE_READWRITETrue1
Fn
MEMWRITEaddress = 0x70000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x664, size = 131072True1
Fn
Data
MEMWRITEaddress = 0x90000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x664, size = 4064True1
Fn
Data
MEMWRITEaddress = 0x470efa, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x664, size = 14True1
Fn
Data
THREADRESUMEprocess_name = c:\windows\syswow64\explorer.exe, os_tid = 0x668, os_pid = 0x664True1
Fn
Thread 0x648
(Host: 1, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
WNDCREATEclass_name = INuDS~K$<F<pyNm^VhBhBg[8MP)]kngCljkp^L)}1X%Nbeti&BOBPKA76h[LjWv>a8{j%2(Pd9S(ru9a*[D#qpxh60mROmuaybP)KKGrgOHjb^*c_e8pija#!g)X=}_C+nBep1A$j$#qu<R}mygj39{>L^O4GSK~DB5B>N]M%^}Jgacj=[0RSxg~e=GD>-@ZJG&[8aN%icI)OfzNcpJ xh1D6u+6oj4jQT6~RtMO%>Tm45[KBz#OR(4$i#b[!<, x_coordinate = 1, y_coordinate = 1, width = 1, height = 1, window_parameter = 0True1
Fn
Process #44: esentutl.exe
(Host: 179, Network: 0)
+
InformationValue
ID / OS PID#44 / 0x4b8
OS Parent PID0x200 (c:\windows\explorer.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe
Command Line"C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exe"
MonitorStart Time: 00:01:10, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:18
OS Thread IDs
#459
0x4BC
#473
0x500
#527
0x5DC
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00030fffPrivate MemoryReadable, WritableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000000500000x000500000x0008ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000900000x000900000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001900000x001900000x00193fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x001a00000x00206fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000002100000x002100000x002eefffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002f00000x002f00000x00305fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000003100000x003100000x0034ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003500000x003500000x00350fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000003600000x003600000x0036ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003700000x003700000x003effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003f00000x003f00000x003f6fffPagefile Backed MemoryReadableTrueFalseFalse
esentutl.exe0x004000000x0042afffMemory Mapped FileReadable, Writable, ExecutableTrueTrueFalse
pagefile_0x00000000004300000x004300000x005b7fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000005c00000x005c00000x005dcfffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
C_1251.NLS0x005e00000x005f0fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000006000000x006000000x006fffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000007000000x007000000x00880fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008900000x008900000x01c8ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001c900000x01c900000x01ccffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000001cd00000x01cd00000x01cd1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
AdapterTroubleshooter.exe0x01ce00000x01ce9fffMemory Mapped FileReadableFalseFalseFalse
AdapterTroubleshooter.exe0x01ce00000x01ce9fffMemory Mapped FileReadableFalseFalseFalse
private_0x0000000001d000000x01d000000x01d0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d100000x01d100000x01e0ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e100000x01e100000x01e4ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001e500000x01e500000x01f4ffffPrivate MemoryReadable, WritableTrueFalseFalse
kernel32.dll.mui0x01f500000x0200ffffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000020100000x020100000x0204ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020500000x020500000x0214ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022200000x022200000x0225ffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x022600000x0252efffMemory Mapped FileReadableFalseFalseFalse
samcli.dll0x73f800000x73f8efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wkscli.dll0x73f900000x73f9efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
srvcli.dll0x73fa00000x73fb8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netutils.dll0x73fc00000x73fc8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
netapi32.dll0x73fd00000x73fe0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mpr.dll0x73ff00000x74001fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x740100000x74018fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winspool.drv0x741500000x741a0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x743500000x743cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x743d00000x7440bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x744100000x74417fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x744200000x7447bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x744800000x744befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x758000000x75812fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x758300000x7583bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x758400000x7589ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x758a00000x758fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x759000000x75a0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x75a100000x75b6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x75b700000x75c0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x75c200000x75c54fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x75c600000x75c69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x75c700000x75da5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x75dc00000x75dcbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x75dd00000x75e26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x75e300000x75f2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x75f300000x76024fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x760300000x760ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x761500000x761dffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x761e00000x76e29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imagehlp.dll0x76ec00000x76ee9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x76ef00000x76f7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76f800000x7704bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x770500000x7713ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x771f00000x77235fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x772400000x772ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x772f00000x7740cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x774100000x77428fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x775400000x7773afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000778e00000x778e00000x779d9fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000779e00000x779e00000x77afefffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x77cb00000x77cb5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77ce00000x77e5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Threads
Thread 0x4bc
(Host: 178, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75900000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualProtect, address = 0x7591435fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\user32.dll, base_address = 0x75e30000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IMPGetIMEA, address = 0x75ea7331True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetForegroundWindow, address = 0x75e6f170True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = ShowWindow, address = 0x75e50dfbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSysColor, address = 0x75e46c3cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetKeyboardLayoutNameA, address = 0x75ea6bd9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = IsWindow, address = 0x75e47136True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetSystemMetrics, address = 0x75e47d2fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetWindowPos, address = 0x75e48e4eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = GetFocus, address = 0x75e50deeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = SetMenuInfo, address = 0x75e9d222True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = DispatchMessageA, address = 0x75e47bbbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\user32.dll, function = InvalidateRect, address = 0x75e51381True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\mswsock.dll, base_address = 0x743d0000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSPStartup, address = 0x743d8a9bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = dn_expand, address = 0x743eb97cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = sethostname, address = 0x743e6582True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = MigrateWinsockConfiguration, address = 0x743dcd27True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = NPLoadNameSpaces, address = 0x743f1a3eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetNameByTypeA, address = 0x743ee59fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = TransmitFile, address = 0x743ec7e2True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = inet_network, address = 0x743e6597True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAddressByNameA, address = 0x743eddb5True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetAcceptExSockaddrs, address = 0x743ec9daTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameW, address = 0x743edfd7True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = WSARecvEx, address = 0x743f1b55True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetServiceW, address = 0x743ef340True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceA, address = 0x743eefaeTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsW, address = 0x743ecc25True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = GetTypeByNameA, address = 0x743ee260True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = SetServiceW, address = 0x743ef118True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StartWsdpService, address = 0x743e633dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = EnumProtocolsA, address = 0x743ed368True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = rexec, address = 0x743e656dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\mswsock.dll, function = StopWsdpService, address = 0x743e5e56True1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75900000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address = 0x75911450True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = InterlockedDecrement, address = 0x759113f0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapCreate, address = 0x75914a2dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetThreadLocale, address = 0x759135cfTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address = 0x75911725True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenW, address = 0x75911700True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FileTimeToSystemTime, address = 0x7591542cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address = 0x7593772fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address = 0x759187c9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount, address = 0x7591110cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address = 0x75911946True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleAliasesA, address = 0x759b6680True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrlenA, address = 0x75915a4bTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiA, address = 0x75913e8eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address = 0x7592d802True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsA, address = 0x7591e349True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address = 0x759151cbTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address = 0x77d21f6eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetFileAttributesW, address = 0x75911b18True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address = 0x75915189True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address = 0x75911809True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringA, address = 0x7593bc39True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address = 0x7593d1a1True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address = 0x759134b0True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address = 0x759151e3True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address = 0x75913509True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = VirtualAlloc, address = 0x75911856True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address = 0x759111f8True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address = 0x7591170dTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address = 0x759117b9True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetHandleCount, address = 0x7591cb29True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeA, address = 0x75938266True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiW, address = 0x7592d5cdTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStrings, address = 0x7591e361True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTime, address = 0x75915a96True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address = 0x7599454fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, function = GlobalSize, address = 0x7592d16fTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\gdi32.dll, base_address = 0x76150000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICW, address = 0x7616c040True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateICA, address = 0x76167c2eTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = GetCharWidth32W, address = 0x7616c93cTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = DeleteObject, address = 0x76165689True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreatePen, address = 0x7616ba4fTrue1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateRectRgnIndirect, address = 0x7616a764True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\gdi32.dll, function = CreateDCA, address = 0x76167bccTrue1
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False10
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True2
Fn
MODGET_HANDLEmodule_name = it, base_address = 0x0False7
Fn
MODLOADmodule_name = CRYPT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WININET.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHLWAPI.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = VERSION.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = MPR.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = imagehlp.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = WS2_32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = KERNEL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ADVAPI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = USER32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ole32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = SHELL32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = ntdll.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = OLEAUT32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = GDI32.dll, base_address = 0x0True1
Fn
MODLOADmodule_name = NETAPI32.dll, base_address = 0x0True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_02False1
Fn
MODGET_HANDLEmodule_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, base_address = 0x400000True1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86)True1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir (x86), data_ident_out = 67True1
Fn
REGCREATE_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDirTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, value_name = ProgramFilesDir, data_ident_out = 67True1
Fn
FILECREATEfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4b8, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x1c90000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4b8, base_address = 0x1c90000True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_00, data_ident_out = 154True1
Fn
REGCREATE_KEYreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01True1
Fn
REGREAD_VALUEreg_name = HKEY_CURRENT_USER\Printers\Defaults\{96846631-2186-5CD6-E75E-DE0C388E7046}, value_name = Component_01, data_ident_out = 103True1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATIONTrue1
Fn
PROCOPEN_TOKENprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ec, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, desired_access = PROCESS_CREATE_THREAD, PROCESS_VM_OPERATIONTrue1
Fn
MUTEXOPENmutex_name = shell.{0835FA03-68AC-09B6-0CE4-703246A746AB}, desired_access = SYNCHRONIZEFalse1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, value_name = EnableLUA, data_ident_out = 1True1
Fn
MODGET_FILENAMEfile_name = C:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}\esentutl.exeTrue1
Fn
MODLOADmodule_name = shell32.dll, base_address = 0x761e0000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\shell32.dll, function = SHCreateItemFromParsingName, address = 0x76234215True1
Fn
MODLOADmodule_name = C:\Windows\SysWOW64\AdapterTroubleshooter.exe, base_address = 0x1ce0001True1
Fn
FILECREATEfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\windows\syswow64\adaptertroubleshooter.exe, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4b8, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x1ce0000True1
Fn
FILECREATE_TMPFILEfile_name = c:\users\hjrd1k~1\appdata\local\temp\8361.tmp, path = C:\Users\HJRD1K~1\AppData\Local\Temp\True1
Fn
FILECOPYdestination_file_name = c:\users\hjrd1k~1\appdata\local\temp\8361.tmp, source_file_name = c:\windows\syswow64\d3d9.dll, fail_if_exists = 0True1
Fn
FILECREATEfile_name = c:\users\hjrd1k~1\appdata\local\temp\8361.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTINGTrue1
Fn
MODCREATE_MAPPINGfile_name = c:\users\hjrd1k~1\appdata\local\temp\8361.tmp, module_name = Nameless FileMapping, maximum_size = 0, protection = PAGE_READONLYTrue1
Fn
MODMAPfile_name = c:\users\hjrd1k~1\appdata\local\temp\8361.tmp, process_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4b8, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x2530000True1
Fn
MODUNMAPprocess_name = c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe, os_pid = 0x4b8, base_address = 0x2530000True1
Fn
FILECREATEfile_name = c:\users\hjrd1k~1\appdata\local\temp\8361.tmp, desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYSTrue1
Fn
FILEWRITEfile_name = c:\users\hjrd1k~1\appdata\local\temp\8361.tmp, size = 1832448True1
Fn
PROCCREATEprocess_name = "C:\Windows\SysWOW64\explorer.exe", os_tid = 0x604, os_pid = 0x600, creation_flags = CREATE_SUSPENDED, CREATE_DETACHED_PROCESS, CREATE_BREAKAWAY_FROM_JOB, CREATE_NO_WINDOW, show_window = SW_HIDETrue1
Fn
PROCGET_INFOprocess_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x600True1
Fn
MEMREADaddress = 0x7efde000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x600, size = 584True1
Fn
Data
MEMREADaddress = 0x440000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x600, size = 1024True1
Fn
Data
MEMALLOCaddress = 0xb0000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x600, size = 135136, allocation_type = MEM_COMMIT, protection = PAGE_EXECUTE_READWRITETrue1
Fn
MEMWRITEaddress = 0xb0000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x600, size = 131072True1
Fn
Data
MEMWRITEaddress = 0xd0000, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x600, size = 4064True1
Fn
Data
MEMWRITEaddress = 0x470efa, process_name = "C:\Windows\SysWOW64\explorer.exe", os_pid = 0x600, size = 14True1
Fn
Data
THREADRESUMEprocess_name = c:\windows\system32\svchost.exe, os_tid = 0x604, os_pid = 0x35cTrue1
Fn
Thread 0x5dc
(Host: 1, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
WNDCREATEclass_name = 90pWIS=rD*^9#mbxu3-#*[+6}d%]VFmphBV_V&Hd9@zAVF%X(>aoqjzIPF2f8F>B]EDpaMSN@_8}W3~A6Lq6OAg}32Im{}gE=_-M[CzdR]5ms}xbVUuz5@&USpp9dzppgB+mApZHNQXxlp~1&H~Px#p=T!u)d%G*K#dcnp>9$Kj)-eN5NQCh+ujQ&^vrqrAvBO+PMq80PtuVEcE@1^n**HJAuna7VPX#][cAFRzKcx5jRU82#!Vh~bv+WFOvc([, x_coordinate = 1, y_coordinate = 1, width = 1, height = 1, window_parameter = 0True1
Fn
Process #45: spoolsv.exe
+
InformationValue
ID / OS PID#45 / 0x4f4
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\spoolsv.exe
Command LineC:\Windows\System32\spoolsv.exe
MonitorStart Time: 00:01:14, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:14
OS Thread IDs
#471
0x4F8
#482
0x520
#483
0x52C
#484
0x530
#487
0x53C
#492
0x554
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000400000x000400000x00040fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000500000x000500000x00051fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000600000x000600000x00060fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000700000x000700000x000affffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x000b00000x00116fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001200000x001200000x00120fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001300000x001300000x0016ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001b00000x001b00000x002affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003000000x003000000x0033ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003400000x003400000x0034ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003500000x003500000x0044ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004500000x004500000x005d7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005e00000x005e00000x00760fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007700000x007700000x01b6ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001b700000x01b700000x01f62fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001fe00000x01fe00000x0201ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020300000x020300000x0206ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000020800000x020800000x020fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000021800000x021800000x021fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000023a00000x023a00000x023affffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
spoolsv.exe0xff8a00000xff92bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x7fefb5f00000x7fefb5fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x7fefba200000x7fefba4bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dnsapi.dll0x7fefd1600000x7fefd1bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x7fefdb400000x7fefdb59fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x7fefe1700000x7fefe346fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd40000x7fffffd40000x7fffffd5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd60000x7fffffd60000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
Process #46: dllhost.exe
+
InformationValue
ID / OS PID#46 / 0x524
OS Parent PID0x234 (c:\windows\system32\svchost.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\dllhost.exe
Command LineC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
MonitorStart Time: 00:01:15, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:13
OS Thread IDs
#485
0x528
#486
0x538
#488
0x540
#493
0x558
#494
0x55C
#495
0x560
#504
0x58C
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000400000x000400000x00040fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000500000x000500000x0014ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x001500000x001b6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000001c00000x001c00000x001c0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001d00000x001d00000x001d0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001e00000x001e00000x001effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001f00000x001f00000x002effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003400000x003400000x0043ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004400000x004400000x005c7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005d00000x005d00000x00750fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007600000x007600000x01b5ffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000001ba00000x01ba00000x01c9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001d000000x01d000000x01dfffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001ed00000x01ed00000x01fcffffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x01fd00000x0229efffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000022a00000x022a00000x0237efffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000023e00000x023e00000x024dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025b00000x025b00000x0262ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000026700000x026700000x0276ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000027700000x027700000x0286ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029000000x029000000x0290ffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
psapi.dll0x77cc00000x77cc6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
dllhost.exe0xff0800000xff086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
PhotoMetadataHandler.dll0x7fef98600000x7fef98cafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x7fefa0200000x7fefa0bffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
thumbcache.dll0x7fefa2e00000x7fefa2fefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
actxprxy.dll0x7fefa9500000x7fefaa3dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WindowsCodecs.dll0x7fefbe000000x7fefbf29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefc3a00000x7fefc3f5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x7fefc4000000x7fefc52bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x7fefd0400000x7fefd086fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefe8600000x7fefe8d0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x7feff0800000x7feffe07fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd60000x7fffffd60000x7fffffd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd80000x7fffffd80000x7fffffd9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffda0000x7fffffda0000x7fffffdbfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdc0000x7fffffdc0000x7fffffddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffde0000x7fffffde0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #47: taskhost.exe
+
InformationValue
ID / OS PID#47 / 0x548
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\taskhost.exe
Command Line"taskhost.exe"
MonitorStart Time: 00:01:16, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:12
OS Thread IDs
#490
0x54C
#497
0x568
#501
0x57C
#508
0x59C
#510
0x5A4
#511
0x5A8
#518
0x5C0
#524
0x5D4
#528
0x5E0
#559
0x660
#573
0x69C
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00033fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000400000x000a6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000000b00000x000b00000x000b1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000c00000x000c00000x000c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000d00000x000d00000x0014ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001500000x001500000x00150fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001600000x001600000x00160fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001700000x001700000x00170fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001800000x001800000x00181fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000002200000x002200000x0022ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002700000x002700000x0036ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003700000x003700000x0046ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004700000x004700000x005f7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000006000000x006000000x00780fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007900000x007900000x01b8ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000001b900000x01b900000x01f82fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000020000000x020000000x0207ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000020800000x020800000x0215efffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000021f00000x021f00000x0226ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000022f00000x022f00000x0236ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000023700000x023700000x023effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000024300000x024300000x024affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000024d00000x024d00000x0254ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000025500000x025500000x025cffffPrivate MemoryReadable, WritableTrueFalseFalse
KernelBase.dll.mui0x025d00000x0268ffffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000026900000x026900000x0270ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000027100000x027100000x0278ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000027e00000x027e00000x0285ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000028600000x028600000x028dffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
taskhost.exe0xffc200000xffc33fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msutb.dll0x7fefb4500000x7fefb48cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x7fefb5f00000x7fefb5fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
MsCtfMonitor.dll0x7fefbcc00000x7fefbccafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
HotStartUserAgent.dll0x7fefbcd00000x7fefbcdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
PlaySndSrv.dll0x7fefbce00000x7fefbcf7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wtsapi32.dll0x7fefbdd00000x7fefbde0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x7fefbf700000x7fefbf87fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x7fefc3a00000x7fefc3f5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winsta.dll0x7fefd9f00000x7fefda2cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdcfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #48: jusched.exe
(Host: 5, Network: 0)
+
InformationValue
ID / OS PID#48 / 0x570
OS Parent PID0x4a4 (c:\windows\syswow64\runonce.exe)
Initial Working DirectoryC:\Windows\SysWOW64
File Namec:\program files (x86)\common files\java\java update\jusched.exe
Command Line"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MonitorStart Time: 00:01:16, Reason: Child Process
UnmonitorEnd Time: 00:01:18, Reason: Terminated
Monitor Duration00:00:02
OS Thread IDs
#499
0x574
#506
0x594
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000200000x000200000x00020fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000300000x000300000x00030fffPrivate MemoryReadable, WritableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000000500000x000500000x00053fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00060fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000700000x000d6fffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000001100000x001100000x0014ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002400000x002400000x0024ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002500000x002500000x0025ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002700000x002700000x0036ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000004700000x004700000x004effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000005f00000x005f00000x006effffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000006f00000x006f00000x00877fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008800000x008800000x00a00fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000bd00000x00bd00000x00c0ffffPrivate MemoryReadable, WritableTrueFalseFalse
jusched.exe0x00f300000x00fc4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x0000000000fd00000x00fd00000x023cffffPagefile Backed MemoryReadableTrueFalseFalse
version.dll0x740100000x74018fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
uxtheme.dll0x743500000x743cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x744100000x74417fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x744200000x7447bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x744800000x744befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msi.dll0x755e00000x7581ffffMemory Mapped FileReadable, Writable, ExecutableTrueFalseFalse
cryptbase.dll0x758300000x7583bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x758400000x7589ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x758a00000x758fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x759000000x75a0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x75a100000x75b6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x75b700000x75c0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x75c600000x75c69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
urlmon.dll0x75c700000x75da5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msasn1.dll0x75dc00000x75dcbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x75dd00000x75e26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x75e300000x75f2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wininet.dll0x75f300000x76024fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x760300000x760ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x761500000x761dffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x761e00000x76e29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x76ef00000x76f7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76f800000x7704bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x770500000x7713ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x771f00000x77235fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x772400000x772ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
crypt32.dll0x772f00000x7740cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x774100000x77428fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
iertutil.dll0x775400000x7773afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000778e00000x778e00000x779d9fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000779e00000x779e00000x77afefffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77ce00000x77e5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Threads
Thread 0x574
(Host: 5, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
PROCGET_INFOprocess_name = c:\users\hjrd1koky ds8lujv\desktop\d8891477315db13a640ed5956a636951.exe, os_pid = 0x6ecTrue1
Fn
MODGET_HANDLEmodule_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75900000True1
Fn
MODGET_PROC_ADDRESSmodule_name = c:\windows\syswow64\kernel32.dll, address = 0x759210b5True1
Fn
REGOPEN_KEYreg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystemTrue1
Fn
REGREAD_VALUEreg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem, value_name = Win31FileSystem, data_ident_out = 0True1
Fn
Process #49: svchost.exe
+
InformationValue
ID / OS PID#49 / 0x580
OS Parent PID0x1a8 (c:\windows\system32\services.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\system32\svchost.exe
Command LineC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
MonitorStart Time: 00:01:17, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:11
OS Thread IDs
#503
0x584
#505
0x590
#513
0x5B0
#516
0x5B8
#517
0x5BC
#521
0x5C8
#532
0x5F0
#556
0x654
#557
0x658
#558
0x65C
#563
0x674
#564
0x678
#567
0x684
#579
0x6B8
#581
0x6C0
#582
0x6C4
#583
0x6C8
#584
0x6CC
#589
0x6E0
#597
0x700
RemarksNo high level activity detected in monitored regions
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00026fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x000affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000b00000x000b00000x000b3fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000c00000x000c00000x000c0fffPagefile Backed MemoryReadableTrueFalseFalse
locale.nls0x000d00000x00136fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000001400000x001400000x00141fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001500000x001500000x00150fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001600000x001600000x00160fffPrivate MemoryReadable, WritableTrueFalseFalse
FirewallAPI.dll.mui0x001700000x0018bfffMemory Mapped FileReadable, WritableFalseFalseFalse
private_0x00000000001900000x001900000x00190fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001a00000x001a00000x001affffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001b00000x001b00000x001b0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001c00000x001c00000x001c0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001d00000x001d00000x0024ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002500000x002500000x00257fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000002600000x002600000x0035ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000003600000x003600000x0045ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004600000x004600000x005e7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000005f00000x005f00000x00770fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000007800000x007800000x0083ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000008400000x008400000x00c32fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000c400000x00c400000x00cbffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000cc00000x00cc00000x00d3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d400000x00d400000x00d43fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d500000x00d500000x00d53fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d600000x00d600000x00d63fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d700000x00d700000x00d73fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d800000x00d800000x00d80fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000d900000x00d900000x00d90fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000da00000x00da00000x00da0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000db00000x00db00000x00db0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000dc00000x00dc00000x00e3ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000e400000x00e400000x00e40fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000e500000x00e500000x00e50fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000e600000x00e600000x00edffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ee00000x00ee00000x00f5ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ee00000x00ee00000x00ee0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000ef00000x00ef00000x00ef0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000f000000x00f000000x00f00fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000f100000x00f100000x00f10fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000f200000x00f200000x00f20fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000f300000x00f300000x00f30fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000f400000x00f400000x00f40fffPrivate MemoryReadable, WritableTrueFalseFalse
SortDefault.nls0x00f600000x0122efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000012300000x012300000x012affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013400000x013400000x013bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000013e00000x013e00000x0145ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000014c00000x014c00000x0153ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015000000x015000000x0157ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000015d00000x015d00000x0164ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000016900000x016900000x0170ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017400000x017400000x017bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000017f00000x017f00000x0186ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000018a00000x018a00000x0191ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000019700000x019700000x019effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001a200000x01a200000x01a9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001ab00000x01ab00000x01b2ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001b500000x01b500000x01bcffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001bd00000x01bd00000x01ccffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000001cd00000x01cd00000x01dcffffPrivate MemoryReadable, WritableTrueFalseFalse
user32.dll0x778e00000x779d9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x779e00000x77afefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
svchost.exe0xffa200000xffa2afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
PeerDistSh.dll0x7fef88c00000x7fef8977fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wdi.dll0x7fef8a200000x7fef8a38fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wfapigp.dll0x7fef8af00000x7fef8af9fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dps.dll0x7fef8cd00000x7fef8cfbfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
MPSSVC.dll0x7fef8d500000x7fef8e1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
BFE.DLL0x7fef9df00000x7fef9e9ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc.dll0x7fefab200000x7fefab37fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dhcpcsvc6.dll0x7fefab400000x7fefab50fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FWPUCLNT.DLL0x7fefab700000x7fefabc2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
winnsi.dll0x7fefb5100000x7fefb51afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
IPHLPAPI.DLL0x7fefb5200000x7fefb546fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x7fefb5f00000x7fefb5fafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
taskschd.dll0x7fefb6600000x7fefb786fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x7fefb9c00000x7fefb9ecfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
version.dll0x7fefcc100000x7fefcc1bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
FirewallAPI.dll0x7fefcc200000x7fefccdafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
WSHTCPIP.DLL0x7fefcce00000x7fefcce6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pcwum.dll0x7fefcda00000x7fefcdacfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gpapi.dll0x7fefcde00000x7fefcdfafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
userenv.dll0x7fefce000000x7fefce1dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
credssp.dll0x7fefcf100000x7fefcf19fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wship6.dll0x7fefd2d00000x7fefd2d6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
mswsock.dll0x7fefd2e00000x7fefd334fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x7fefd3400000x7fefd356fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
authz.dll0x7fefd5100000x7fefd53efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x7fefd8b00000x7fefd8bafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x7fefd9100000x7fefd934fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x7fefd9400000x7fefd94efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x7fefda300000x7fefda43fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x7fefda500000x7fefda5efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x7fefdd700000x7fefdda5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x7fefddb00000x7fefde1afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x7fefde200000x7fefde2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x7fefe0900000x7fefe166fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x7fefe3500000x7fefe3e8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ws2_32.dll0x7fefe3f00000x7fefe43cfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x7fefe4400000x7fefe642fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x7fefe7800000x7fefe85afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x7fefe8600000x7fefe8d0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x7fefe8e00000x7fefe97efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x7fefe9800000x7fefe99efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x7fefe9a00000x7fefe9cdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x7fefe9d00000x7fefeafcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x7fefec200000x7fefec71fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x7fefec800000x7fefed88fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
nsi.dll0x7fefef100000x7fefef17fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x7fefef200000x7fefef86fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x7fefefb00000x7feff078fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
apisetschema.dll0x7feffe200000x7feffe20fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000007fffff9a0000x7fffff9a0000x7fffff9bfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9c0000x7fffff9c0000x7fffff9dfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffff9e0000x7fffff9e0000x7fffff9ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa00000x7fffffa00000x7fffffa1fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa20000x7fffffa20000x7fffffa3fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa40000x7fffffa40000x7fffffa5fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa60000x7fffffa60000x7fffffa7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffa80000x7fffffa80000x7fffffa9fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffaa0000x7fffffaa0000x7fffffabfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffac0000x7fffffac0000x7fffffadfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffae0000x7fffffae0000x7fffffaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000007fffffb00000x7fffffb00000x7fffffd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000007fffffd30000x7fffffd30000x7fffffd4fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd50000x7fffffd50000x7fffffd6fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd70000x7fffffd70000x7fffffd8fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffd90000x7fffffd90000x7fffffdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdb0000x7fffffdb0000x7fffffdcfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdd0000x7fffffdd0000x7fffffdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000007fffffdf0000x7fffffdf0000x7fffffdffffPrivate MemoryReadable, WritableTrueFalseFalse
Process #50: explorer.exe
(Host: 5, Network: 0)
+
InformationValue
ID / OS PID#50 / 0x600
OS Parent PID0x4b8 (c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\syswow64\explorer.exe
Command Line"C:\Windows\SysWOW64\explorer.exe"
MonitorStart Time: 00:01:21, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:07
OS Thread IDs
#536
0x604
#543
0x624
#545
0x62C
#586
0x6D4
#593
0x6F0
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00021fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00036fffPagefile Backed MemoryReadableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000000500000x000500000x00053fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00061fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000700000x000700000x000affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000b00000x000b00000x000d0fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
locale.nls0x000e00000x00146fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000001500000x001500000x00151fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001600000x001600000x00160fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001700000x001700000x001affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001b00000x001b00000x001b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001c00000x001c00000x001dffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001e00000x001e00000x001e0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001f00000x001f00000x001f0fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000002000000x002000000x00200fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002100000x002100000x00211fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x002200000x00223fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000002300000x002300000x00231fffPagefile Backed MemoryReadableTrueFalseFalse
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db0x002400000x00255fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000002600000x002600000x0029ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002a00000x002a00000x002a0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x002b00000x002b3fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000002c00000x002c00000x002cffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002d00000x002d00000x002d0fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002e00000x002e00000x0035ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003600000x003600000x0043efffPagefile Backed MemoryReadableTrueFalseFalse
explorer.exe0x004400000x006c0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db0x006d00000x006fffffMemory Mapped FileReadableTrueFalseFalse
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db0x007000000x00765fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000007b00000x007b00000x007effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000008000000x008000000x008fffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000009000000x009000000x00a87fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000a900000x00a900000x00c10fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000c200000x00c200000x0201ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000020200000x020200000x02412fffPagefile Backed MemoryReadableTrueFalseFalse
SortDefault.nls0x024200000x026eefffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000027400000x027400000x0277ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000027f00000x027f00000x0282ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000028800000x028800000x028bffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029100000x029100000x0294ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029700000x029700000x029affffPrivate MemoryReadable, WritableTrueFalseFalse
uxtheme.dll0x743500000x743cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x744100000x74417fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x744200000x7447bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x744800000x744befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x74e200000x74e2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x74e300000x74e6afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x74e700000x74e85fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
atl.dll0x74e900000x74ea3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comsvcs.dll0x74eb00000x74fe5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x750e00000x750eafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x750f00000x75110fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x751200000x752bdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x752c00000x753b4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x753c00000x753c7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
GdiPlus.dll0x753d00000x7555ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x755600000x75569fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x755700000x75594fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dui70.dll0x755a00000x75651fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
duser.dll0x756600000x7568efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ExplorerFrame.dll0x756900000x757fefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x758000000x75812fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x758300000x7583bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x758400000x7589ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x758a00000x758fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x759000000x75a0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x75a100000x75b6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x75b700000x75c0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x75c600000x75c69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x75dd00000x75e26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x75e300000x75f2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x760300000x760ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x760d00000x760e1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x761500000x761dffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x761e00000x76e29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x76ef00000x76f7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76f800000x7704bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x770500000x7713ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x771c00000x771e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x771f00000x77235fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x772400000x772ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x774100000x77428fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x774600000x774e2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x774f00000x77534fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x777400000x778dcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000778e00000x778e00000x779d9fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000779e00000x779e00000x77afefffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77ce00000x77e5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Injection Information
+
Injection TypeSource ProcessSource Os Thread IDInjection InfoSuccessCountLogfile
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4bcaddress = 0xb0000, size = 131072True1
Fn
Data
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4bcaddress = 0xd0000, size = 4064True1
Fn
Data
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4bcaddress = 0x470efa, size = 14True1
Fn
Data
Threads
Thread 0x604
(Host: 5, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
COMCREATEclass_name = FileOperation, interface = IFileOperation, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVERTrue1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = SetOperationFlagsTrue1
Fn
SYSCREATE_SHELL_ITEMdisplay_name = C:\Windows\SysWOW64True1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = newItemTrue1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = PerformOperationsFalse1
Fn
Process #51: explorer.exe
(Host: 5, Network: 0)
+
InformationValue
ID / OS PID#51 / 0x608
OS Parent PID0x49c (c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe)
Initial Working DirectoryC:\Windows\system32
File Namec:\windows\syswow64\explorer.exe
Command Line"C:\Windows\SysWOW64\explorer.exe"
MonitorStart Time: 00:01:21, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:07
OS Thread IDs
#537
0x60C
#541
0x61C
#544
0x628
#588
0x6DC
#596
0x6FC
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00021fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00036fffPagefile Backed MemoryReadableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000000500000x000500000x00053fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00061fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000700000x000700000x00090fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
pagefile_0x00000000000a00000x000a00000x000a1fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000000b00000x000b00000x000b0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000c00000x000c00000x000c0fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000000d00000x000d00000x0010ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001100000x001100000x0012ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001300000x001300000x00130fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001400000x001400000x00140fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000001500000x001500000x0018ffffPrivate MemoryReadable, WritableTrueFalseFalse
locale.nls0x001900000x001f6fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000002000000x002000000x00200fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002100000x002100000x00211fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x002200000x00223fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000002300000x002300000x00231fffPagefile Backed MemoryReadableTrueFalseFalse
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db0x002400000x00255fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000002600000x002600000x00260fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x002700000x00273fffMemory Mapped FileReadableTrueFalseFalse
pagefile_0x00000000002800000x002800000x00280fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000002900000x002900000x0030ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003100000x003100000x003eefffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000004000000x004000000x0043ffffPrivate MemoryReadable, WritableTrueFalseFalse
explorer.exe0x004400000x006c0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db0x006d00000x006fffffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000007300000x007300000x0076ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007d00000x007d00000x008cffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000008d00000x008d00000x00a57fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x0000000000a700000x00a700000x00a7ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000000a800000x00a800000x00c00fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000c100000x00c100000x0200ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000020100000x020100000x02402fffPagefile Backed MemoryReadableTrueFalseFalse
SortDefault.nls0x024100000x026defffMemory Mapped FileReadableFalseFalseFalse
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db0x026e00000x02745fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000027500000x027500000x0278ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000027a00000x027a00000x027dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000028000000x028000000x0283ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029700000x029700000x029affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029c00000x029c00000x029fffffPrivate MemoryReadable, WritableTrueFalseFalse
uxtheme.dll0x743500000x743cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x744100000x74417fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x744200000x7447bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x744800000x744befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x74e200000x74e2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x74e300000x74e6afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x74e700000x74e85fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
atl.dll0x74e900000x74ea3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comsvcs.dll0x74eb00000x74fe5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x750e00000x750eafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x750f00000x75110fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x751200000x752bdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x752c00000x753b4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x753c00000x753c7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
GdiPlus.dll0x753d00000x7555ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x755600000x75569fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x755700000x75594fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dui70.dll0x755a00000x75651fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
duser.dll0x756600000x7568efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ExplorerFrame.dll0x756900000x757fefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x758000000x75812fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x758300000x7583bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x758400000x7589ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x758a00000x758fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x759000000x75a0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x75a100000x75b6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x75b700000x75c0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x75c600000x75c69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x75dd00000x75e26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x75e300000x75f2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x760300000x760ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x760d00000x760e1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x761500000x761dffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x761e00000x76e29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x76ef00000x76f7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76f800000x7704bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x770500000x7713ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x771c00000x771e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x771f00000x77235fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x772400000x772ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x774100000x77428fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x774600000x774e2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x774f00000x77534fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x777400000x778dcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000778e00000x778e00000x779d9fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000779e00000x779e00000x77afefffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77ce00000x77e5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Injection Information
+
Injection TypeSource ProcessSource Os Thread IDInjection InfoSuccessCountLogfile
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4a0address = 0x70000, size = 131072True1
Fn
Data
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4a0address = 0x90000, size = 4064True1
Fn
Data
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4a0address = 0x470efa, size = 14True1
Fn
Data
Threads
Thread 0x60c
(Host: 5, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
COMCREATEclass_name = FileOperation, interface = IFileOperation, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVERTrue1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = SetOperationFlagsTrue1
Fn
SYSCREATE_SHELL_ITEMdisplay_name = C:\Windows\SysWOW64True1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = newItemTrue1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = PerformOperationsFalse1
Fn
Process #52: explorer.exe
(Host: 5, Network: 0)
+
InformationValue
ID / OS PID#52 / 0x664
OS Parent PID0x4ac (c:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe)
Initial Working DirectoryC:\Users\hJrD1KOKY DS8lUjv\AppData\Roaming\{B3889326-9C2C-0B70-124E-56B7B618030C}
File Namec:\windows\syswow64\explorer.exe
Command Line"C:\Windows\SysWOW64\explorer.exe"
MonitorStart Time: 00:01:24, Reason: Child Process
UnmonitorEnd Time: 00:01:28, Reason: Terminated by Timeout
Monitor Duration00:00:04
OS Thread IDs
#560
0x668
#562
0x670
#568
0x688
#587
0x6D8
#594
0x6F4
Region
+
NameStart VAEnd VATypePermissionsMonitoredDumpYARA MatchActions
private_0x00000000000100000x000100000x0002ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000100000x000100000x0001ffffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000200000x000200000x00021fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000300000x000300000x00031fffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000000300000x000300000x00036fffPagefile Backed MemoryReadableTrueFalseFalse
apisetschema.dll0x000400000x00040fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
pagefile_0x00000000000500000x000500000x00053fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000000600000x000600000x00061fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x00000000000700000x000700000x00090fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
locale.nls0x000a00000x00106fffMemory Mapped FileReadableFalseFalseFalse
pagefile_0x00000000001100000x001100000x00111fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
private_0x00000000001200000x001200000x00120fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001300000x001300000x00130fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001400000x001400000x0015ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001600000x001600000x00160fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001700000x001700000x00170fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000001800000x001800000x00180fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000001900000x001900000x00191fffPagefile Backed MemoryReadableTrueFalseFalse
cversions.2.db0x001a00000x001a3fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000001b00000x001b00000x001effffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000001f00000x001f00000x0022ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000002300000x002300000x0030efffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000003100000x003100000x00311fffPagefile Backed MemoryReadableTrueFalseFalse
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db0x003200000x00335fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000003400000x003400000x003bffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000003c00000x003c00000x003c0fffPagefile Backed MemoryReadable, WritableTrueFalseFalse
cversions.2.db0x003d00000x003d3fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000003e00000x003e00000x0041ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x00000000004200000x004200000x00420fffPagefile Backed MemoryReadableTrueFalseFalse
explorer.exe0x004400000x006c0fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db0x006d00000x006fffffMemory Mapped FileReadableTrueFalseFalse
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db0x007000000x00765fffMemory Mapped FileReadableTrueFalseFalse
private_0x00000000007700000x007700000x007affffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000007e00000x007e00000x008dffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009000000x009000000x0093ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000009c00000x009c00000x009fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x0000000000a300000x00a300000x00a3ffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x0000000000a400000x00a400000x00bc7fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000bd00000x00bd00000x00d50fffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x0000000000d600000x00d600000x0215ffffPagefile Backed MemoryReadableTrueFalseFalse
pagefile_0x00000000021600000x021600000x02552fffPagefile Backed MemoryReadableTrueFalseFalse
SortDefault.nls0x025600000x0282efffMemory Mapped FileReadableFalseFalseFalse
private_0x00000000028c00000x028c00000x028fffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029100000x029100000x0294ffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x00000000029b00000x029b00000x029effffPrivate MemoryReadable, WritableTrueFalseFalse
uxtheme.dll0x743500000x743cffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64cpu.dll0x744100000x74417fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64win.dll0x744200000x7447bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
wow64.dll0x744800000x744befffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
RpcRtRemote.dll0x74e200000x74e2dfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rsaenh.dll0x74e300000x74e6afffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptsp.dll0x74e700000x74e85fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
atl.dll0x74e900000x74ea3fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comsvcs.dll0x74eb00000x74fe5fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
profapi.dll0x750e00000x750eafffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntmarta.dll0x750f00000x75110fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
comctl32.dll0x751200000x752bdfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
propsys.dll0x752c00000x753b4fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
secur32.dll0x753c00000x753c7fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
GdiPlus.dll0x753d00000x7555ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
slc.dll0x755600000x75569fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
powrprof.dll0x755700000x75594fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dui70.dll0x755a00000x75651fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
duser.dll0x756600000x7568efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ExplorerFrame.dll0x756900000x757fefffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
dwmapi.dll0x758000000x75812fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cryptbase.dll0x758300000x7583bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sspicli.dll0x758400000x7589ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
imm32.dll0x758a00000x758fffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
kernel32.dll0x759000000x75a0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ole32.dll0x75a100000x75b6bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
advapi32.dll0x75b700000x75c0ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
lpk.dll0x75c600000x75c69fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shlwapi.dll0x75dd00000x75e26fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
user32.dll0x75e300000x75f2ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
usp10.dll0x760300000x760ccfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
devobj.dll0x760d00000x760e1fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
gdi32.dll0x761500000x761dffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
shell32.dll0x761e00000x76e29fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
oleaut32.dll0x76ef00000x76f7efffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msctf.dll0x76f800000x7704bfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
rpcrt4.dll0x770500000x7713ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
cfgmgr32.dll0x771c00000x771e6fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
KernelBase.dll0x771f00000x77235fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
msvcrt.dll0x772400000x772ebfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
sechost.dll0x774100000x77428fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
clbcatq.dll0x774600000x774e2fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
Wldap32.dll0x774f00000x77534fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
setupapi.dll0x777400000x778dcfffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x00000000778e00000x778e00000x779d9fffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
private_0x00000000779e00000x779e00000x77afefffPrivate MemoryReadable, Writable, ExecutableTrueFalseFalse
ntdll.dll0x77b000000x77ca8fffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
ntdll.dll0x77ce00000x77e5ffffMemory Mapped FileReadable, Writable, ExecutableFalseFalseFalse
private_0x000000007efad0000x7efad0000x7efaffffPrivate MemoryReadable, WritableTrueFalseFalse
pagefile_0x000000007efb00000x7efb00000x7efd2fffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007efd50000x7efd50000x7efd7fffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efd80000x7efd80000x7efdafffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdb0000x7efdb0000x7efddfffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efde0000x7efde0000x7efdefffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efdf0000x7efdf0000x7efdffffPrivate MemoryReadable, WritableTrueFalseFalse
private_0x000000007efe00000x7efe00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
pagefile_0x000000007efe00000x7efe00000x7f0dffffPagefile Backed MemoryReadableTrueFalseFalse
private_0x000000007f0e00000x7f0e00000x7ffdffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007ffe00000x7ffe00000x7ffeffffPrivate MemoryReadableTrueFalseFalse
private_0x000000007fff00000x7fff00000x7fffffeffffPrivate MemoryReadableTrueFalseFalse
Injection Information
+
Injection TypeSource ProcessSource Os Thread IDInjection InfoSuccessCountLogfile
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4b0address = 0x70000, size = 131072True1
Fn
Data
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4b0address = 0x90000, size = 4064True1
Fn
Data
Modify Memoryc:\users\hjrd1koky ds8lujv\appdata\roaming\{b3889326-9c2c-0b70-124e-56b7b618030c}\esentutl.exe0x4b0address = 0x470efa, size = 14True1
Fn
Data
Threads
Thread 0x668
(Host: 5, Network: 0)
+
CategoryOperationInformationSuccessCountLogfile
COMCREATEclass_name = FileOperation, interface = IFileOperation, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVERTrue1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = SetOperationFlagsTrue1
Fn
SYSCREATE_SHELL_ITEMdisplay_name = C:\Windows\SysWOW64True1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = newItemTrue1
Fn
COMMETHODclass_name = FileOperation, interface = IFileOperation, method = PerformOperationsFalse1
Fn
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefox with deactivated setting "security.fileuri.strict_origin_policy".


Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image