d878a7c8...3ba3

Process Overview

»

ID	PID	Monitor Reason	Integrity Level	Image Name	Command Line	Origin ID
#1	0x938	Analysis Target	Medium	excel.exe	"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"	-
#2	0x368	RPC Server	System (Elevated)	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs	#1
#4	0xb64	RPC Server	System (Elevated)	wmiprvse.exe	C:\Windows\system32\wbem\wmiprvse.exe -Embedding	#2
#5	0xb98	RPC Server	System (Elevated)	msiexec.exe	C:\Windows\system32\msiexec.exe /V	#4

Process #1: excel.exe

11734

5

»

Information	Value
ID	#1
File Name	c:\program files\microsoft office\root\office16\excel.exe
Command Line	"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:00:29, Reason: Analysis Target
Unmonitor	End Time: 00:03:53, Reason: Self Terminated
Monitor Duration	00:03:24

OS Process Information

»

Information	Value
PID	0x938
Parent PID	0x460 (c:\windows\explorer.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x A6C 0x A68 0x A60 0x A5C 0x A10 0x A0C 0x A08 0x A04 0x 9EC 0x 9E8 0x 9E4 0x 9E0 0x 9A8 0x 9A4 0x 9A0 0x 99C 0x 990 0x 98C 0x 988 0x 984 0x 980 0x 97C 0x 978 0x 958 0x 954 0x 950 0x 94C 0x 948 0x 944 0x 940 0x 93C 0x A70 0x A74 0x A78 0x A7C 0x A80 0x A88 0x A94 0x A98 0x B24 0x B2C 0x BFC 0x 66C 0x 92C 0x A74 0x 6D8 0x BC4 0x 740 0x 780 0x 7FC 0x 708 0x AF8

Region

»

Name	Start VA	End VA	Type	Permissions	Actions
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	rw	-
pagefile_0x0000000000020000	0x00020000	0x00020fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	r	-
private_0x0000000000050000	0x00050000	0x00050fff	Private Memory	rw	-
private_0x0000000000060000	0x00060000	0x00060fff	Private Memory	rw	-
pagefile_0x0000000000070000	0x00070000	0x00070fff	Pagefile Backed Memory	rw	-
pagefile_0x0000000000080000	0x00080000	0x00086fff	Pagefile Backed Memory	r	-
private_0x0000000000090000	0x00090000	0x0018ffff	Private Memory	rw	-
pagefile_0x0000000000190000	0x00190000	0x00191fff	Pagefile Backed Memory	rw	-
private_0x00000000001a0000	0x001a0000	0x001a0fff	Private Memory	rw	-
private_0x00000000001b0000	0x001b0000	0x002affff	Private Memory	rw	-
locale.nls	0x002b0000	0x00316fff	Memory Mapped File	r	-
private_0x0000000000320000	0x00320000	0x00320fff	Private Memory	rw	-
pagefile_0x0000000000330000	0x00330000	0x00332fff	Pagefile Backed Memory	r	-
private_0x0000000000340000	0x00340000	0x0034ffff	Private Memory	-	-
pagefile_0x0000000000350000	0x00350000	0x00352fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000360000	0x00360000	0x00362fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000370000	0x00370000	0x00372fff	Pagefile Backed Memory	r	-
private_0x0000000000380000	0x00380000	0x0038ffff	Private Memory	rw	-
private_0x0000000000390000	0x00390000	0x0048ffff	Private Memory	rw	-
pagefile_0x0000000000490000	0x00490000	0x00617fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000620000	0x00620000	0x007a0fff	Pagefile Backed Memory	r	-
pagefile_0x00000000007b0000	0x007b0000	0x01baffff	Pagefile Backed Memory	r	-
sortdefault.nls	0x01bb0000	0x01e7efff	Memory Mapped File	r	-
pagefile_0x0000000001e80000	0x01e80000	0x02272fff	Pagefile Backed Memory	r	-
pagefile_0x0000000002280000	0x02280000	0x02282fff	Pagefile Backed Memory	r	-
pagefile_0x0000000002290000	0x02290000	0x02292fff	Pagefile Backed Memory	r	-
pagefile_0x00000000022a0000	0x022a0000	0x022a1fff	Pagefile Backed Memory	r	-
pagefile_0x00000000022b0000	0x022b0000	0x022b1fff	Pagefile Backed Memory	r	-
private_0x00000000022c0000	0x022c0000	0x022c0fff	Private Memory	rw	-
private_0x00000000022d0000	0x022d0000	0x0230ffff	Private Memory	rw	-
pagefile_0x0000000002310000	0x02310000	0x02310fff	Pagefile Backed Memory	rw	-
private_0x0000000002320000	0x02320000	0x0232ffff	Private Memory	rw	-
private_0x0000000002330000	0x02330000	0x0242ffff	Private Memory	rw	-
private_0x0000000002430000	0x02430000	0x0262ffff	Private Memory	rw	-
pagefile_0x0000000002630000	0x02630000	0x02634fff	Pagefile Backed Memory	rw	-
pagefile_0x0000000002640000	0x02640000	0x02641fff	Pagefile Backed Memory	r	-
private_0x0000000002650000	0x02650000	0x0265ffff	Private Memory	rw	-
index.dat	0x02660000	0x0266bfff	Memory Mapped File	rw	-
index.dat	0x02670000	0x02677fff	Memory Mapped File	rw	-
private_0x0000000002680000	0x02680000	0x026fffff	Private Memory	rw	-
pagefile_0x0000000002700000	0x02700000	0x027defff	Pagefile Backed Memory	r	-
index.dat	0x027e0000	0x027effff	Memory Mapped File	rw	-
pagefile_0x00000000027f0000	0x027f0000	0x027f0fff	Pagefile Backed Memory	r	-
pagefile_0x0000000002800000	0x02800000	0x02800fff	Pagefile Backed Memory	r	-
pagefile_0x0000000002810000	0x02810000	0x02810fff	Pagefile Backed Memory	r	-
pagefile_0x0000000002820000	0x02820000	0x02820fff	Pagefile Backed Memory	r	-
pagefile_0x0000000002830000	0x02830000	0x02831fff	Pagefile Backed Memory	r	-
private_0x0000000002840000	0x02840000	0x02840fff	Private Memory	rw	-
private_0x0000000002850000	0x02850000	0x02850fff	Private Memory	rw	-
private_0x0000000002860000	0x02860000	0x02860fff	Private Memory	rw	-
private_0x0000000002870000	0x02870000	0x0287ffff	Private Memory	rw	-
private_0x0000000002880000	0x02880000	0x0297ffff	Private Memory	rw	-
private_0x0000000002980000	0x02980000	0x02980fff	Private Memory	rw	-
private_0x0000000002990000	0x02990000	0x02990fff	Private Memory	rw	-
private_0x00000000029a0000	0x029a0000	0x02a9ffff	Private Memory	rw	-
xlintl32.dll	0x02aa0000	0x03ae7fff	Memory Mapped File	r	-
private_0x0000000003af0000	0x03af0000	0x03beffff	Private Memory	rw	-
private_0x0000000003bf0000	0x03bf0000	0x03ceffff	Private Memory	rw	-
kernelbase.dll.mui	0x03cf0000	0x03daffff	Memory Mapped File	rw	-
private_0x0000000003db0000	0x03db0000	0x03db0fff	Private Memory	rw	-
private_0x0000000003dc0000	0x03dc0000	0x03ebffff	Private Memory	rw	-
pagefile_0x0000000003ec0000	0x03ec0000	0x03ec1fff	Pagefile Backed Memory	r	-
pagefile_0x0000000003ed0000	0x03ed0000	0x03ed0fff	Pagefile Backed Memory	r	-
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000018.db	0x03ee0000	0x03efffff	Memory Mapped File	r	-
pagefile_0x0000000003f00000	0x03f00000	0x03f00fff	Pagefile Backed Memory	rw	-
private_0x0000000003f10000	0x03f10000	0x0400ffff	Private Memory	rw	-
private_0x0000000004010000	0x04010000	0x04021fff	Private Memory	rw	-
private_0x0000000004030000	0x04030000	0x04030fff	Private Memory	rw	-
private_0x0000000004040000	0x04040000	0x04040fff	Private Memory	rw	-
private_0x0000000004050000	0x04050000	0x0414ffff	Private Memory	rw	-
private_0x0000000004150000	0x04150000	0x04150fff	Private Memory	rw	-
private_0x0000000004160000	0x04160000	0x04171fff	Private Memory	rw	-
private_0x0000000004180000	0x04180000	0x04181fff	Private Memory	rw	-
private_0x0000000004190000	0x04190000	0x04190fff	Private Memory	rw	-
pagefile_0x00000000041a0000	0x041a0000	0x041a1fff	Pagefile Backed Memory	r	-
pagefile_0x00000000041b0000	0x041b0000	0x041b1fff	Pagefile Backed Memory	r	-
pagefile_0x00000000041c0000	0x041c0000	0x041c1fff	Pagefile Backed Memory	r	-
pagefile_0x00000000041d0000	0x041d0000	0x041d0fff	Pagefile Backed Memory	r	-
pagefile_0x00000000041e0000	0x041e0000	0x041e1fff	Pagefile Backed Memory	r	-
private_0x00000000041f0000	0x041f0000	0x041f1fff	Private Memory	rw	-
c_1255.nls	0x04200000	0x04210fff	Memory Mapped File	r	-
pagefile_0x0000000004220000	0x04220000	0x04221fff	Pagefile Backed Memory	r	-
private_0x0000000004230000	0x04230000	0x0423ffff	Private Memory	rw	-
private_0x0000000004240000	0x04240000	0x0433ffff	Private Memory	rw	-
segoeui.ttf	0x04340000	0x043befff	Memory Mapped File	r	-
private_0x00000000043c0000	0x043c0000	0x04407fff	Private Memory	rw	-
cversions.2.db	0x04410000	0x04413fff	Memory Mapped File	r	-
cversions.2.db	0x04420000	0x04423fff	Memory Mapped File	r	-
private_0x0000000004430000	0x04430000	0x044affff	Private Memory	rwx	-
pagefile_0x00000000044b0000	0x044b0000	0x044b1fff	Pagefile Backed Memory	r	-
comdlg32.dll.mui	0x044c0000	0x044ccfff	Memory Mapped File	rw	-
private_0x00000000044d0000	0x044d0000	0x045cffff	Private Memory	rw	-
private_0x00000000045d0000	0x045d0000	0x046cffff	Private Memory	rw	-
pagefile_0x00000000046d0000	0x046d0000	0x04acffff	Pagefile Backed Memory	r	-
private_0x0000000004ad0000	0x04ad0000	0x04b17fff	Private Memory	rw	-
private_0x0000000004b20000	0x04b20000	0x04b21fff	Private Memory	rw	-
private_0x0000000004b30000	0x04b30000	0x04b30fff	Private Memory	rw	-
private_0x0000000004b40000	0x04b40000	0x04b40fff	Private Memory	rw	-
private_0x0000000004b50000	0x04b50000	0x04b50fff	Private Memory	rw	-
private_0x0000000004b60000	0x04b60000	0x04b6ffff	Private Memory	rw	-
private_0x0000000004b70000	0x04b70000	0x04b70fff	Private Memory	rw	-
private_0x0000000004b80000	0x04b80000	0x04c7ffff	Private Memory	rw	-
private_0x0000000004c80000	0x04c80000	0x04c80fff	Private Memory	rw	-
private_0x0000000004c90000	0x04c90000	0x04c90fff	Private Memory	rw	-
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db	0x04ca0000	0x04ccffff	Memory Mapped File	r	-
pagefile_0x0000000004cd0000	0x04cd0000	0x04cd1fff	Pagefile Backed Memory	r	-
pagefile_0x0000000004ce0000	0x04ce0000	0x04ce1fff	Pagefile Backed Memory	r	-
private_0x0000000004cf0000	0x04cf0000	0x04deffff	Private Memory	rw	-
private_0x0000000004df0000	0x04df0000	0x051effff	Private Memory	rw	-
pagefile_0x00000000051f0000	0x051f0000	0x05532fff	Pagefile Backed Memory	r	-
pagefile_0x0000000005540000	0x05540000	0x05d3ffff	Pagefile Backed Memory	rw	-
private_0x0000000005d40000	0x05d40000	0x05e3ffff	Private Memory	rw	-
pagefile_0x0000000005e40000	0x05e40000	0x05e41fff	Pagefile Backed Memory	r	-
private_0x0000000005e50000	0x05e50000	0x05e52fff	Private Memory	rw	-
private_0x0000000005e60000	0x05e60000	0x05e62fff	Private Memory	rw	-
private_0x0000000005e70000	0x05e70000	0x05e70fff	Private Memory	rw	-
private_0x0000000005e80000	0x05e80000	0x05e8ffff	Private Memory	rw	-
private_0x0000000005e90000	0x05e90000	0x05e92fff	Private Memory	rw	-
private_0x0000000005ea0000	0x05ea0000	0x05ea2fff	Private Memory	rw	-
private_0x0000000005eb0000	0x05eb0000	0x05ebffff	Private Memory	rw	-
private_0x0000000005ec0000	0x05ec0000	0x05ec1fff	Private Memory	rw	-
private_0x0000000005ed0000	0x05ed0000	0x05f4ffff	Private Memory	rw	-
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db	0x05f50000	0x05fb5fff	Memory Mapped File	r	-
private_0x0000000005fc0000	0x05fc0000	0x05fc0fff	Private Memory	rw	-
private_0x0000000005fd0000	0x05fd0000	0x05fd0fff	Private Memory	rw	-
private_0x0000000005fe0000	0x05fe0000	0x060dffff	Private Memory	rw	-
pagefile_0x00000000060e0000	0x060e0000	0x060e1fff	Pagefile Backed Memory	r	-
private_0x00000000060f0000	0x060f0000	0x060f0fff	Private Memory	rw	-
private_0x0000000006100000	0x06100000	0x06100fff	Private Memory	rw	-
private_0x0000000006110000	0x06110000	0x06110fff	Private Memory	rw	-
cversions.2.db	0x06120000	0x06123fff	Memory Mapped File	r	-
{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db	0x06130000	0x06130fff	Memory Mapped File	r	-
private_0x0000000006140000	0x06140000	0x0623ffff	Private Memory	rw	-
private_0x0000000006240000	0x06240000	0x06240fff	Private Memory	rw	-
private_0x0000000006250000	0x06250000	0x06250fff	Private Memory	rw	-
private_0x0000000006260000	0x06260000	0x06260fff	Private Memory	rw	-
private_0x0000000006270000	0x06270000	0x06270fff	Private Memory	rw	-
private_0x0000000006280000	0x06280000	0x06280fff	Private Memory	rw	-
private_0x0000000006290000	0x06290000	0x0629ffff	Private Memory	rw	-
private_0x00000000062a0000	0x062a0000	0x062a0fff	Private Memory	rw	-
private_0x00000000062b0000	0x062b0000	0x062b0fff	Private Memory	rw	-
private_0x00000000062c0000	0x062c0000	0x062c0fff	Private Memory	rw	-
private_0x00000000062d0000	0x062d0000	0x062d0fff	Private Memory	rw	-
private_0x00000000062e0000	0x062e0000	0x062e0fff	Private Memory	rw	-
private_0x00000000062f0000	0x062f0000	0x062f0fff	Private Memory	rw	-
private_0x0000000006300000	0x06300000	0x06300fff	Private Memory	rw	-
private_0x0000000006310000	0x06310000	0x06310fff	Private Memory	rw	-
cversions.2.db	0x06320000	0x06323fff	Memory Mapped File	r	-
For performance reasons, the remaining 435 entries are omitted. The remaining entries can be found in flog.txt.

Threads

Thread 0x93c

5689

5

»

Category	Operation	Information	Count	Logfile
System	Get Time	type = System Time, time = 2019-02-17 13:35:04 (UTC)	1	Fn
System	Get Time	type = Ticks, time = 107578	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = Unknown module name, base_address = 0x13f250000	1	Fn
Module	Load	module_name = Comctl32.dll, base_address = 0x7fefc030000	1	Fn
Module	Get Handle	module_name = MSI.DLL, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsiProvideQualifiedComponentA, address_out = 0x7fef9a83b3c	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsiGetProductCodeA, address_out = 0x7fef9a7a13c	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsiReinstallFeatureA, address_out = 0x7fef9a81618	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsiProvideComponentA, address_out = 0x7fef9a7f088	1	Fn
Module	Get Handle	module_name = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL, base_address = 0x0	1	Fn
Module	Load	module_name = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL, base_address = 0x7fee57a0000	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoVBADigSigCallDlg, address_out = 0x7fee58a72c0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoVbaInitSecurity, address_out = 0x7fee58160b0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFIEPolicyAndVersion, address_out = 0x7fee57c1a60	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFAnsiCodePageSupportsLCID, address_out = 0x7fee5815f50	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFInitOffice, address_out = 0x7fee57bf000	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoUninitOffice, address_out = 0x7fee57ae860	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFGetFontSettings, address_out = 0x7fee57a3fc0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoRgchToRgwch, address_out = 0x7fee57b2380	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoHrSimpleQueryInterface, address_out = 0x7fee57a7b80	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoHrSimpleQueryInterface2, address_out = 0x7fee57a7b20	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFCreateControl, address_out = 0x7fee57a8730	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFLongLoad, address_out = 0x7fee58e3260	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFLongSave, address_out = 0x7fee58e3280	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFGetTooltips, address_out = 0x7fee57b1f40	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFSetTooltips, address_out = 0x7fee5816370	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFLoadToolbarSet, address_out = 0x7fee5804590	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFCreateToolbarSet, address_out = 0x7fee57a55b0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoHpalOffice, address_out = 0x7fee57b0240	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFWndProcNeeded, address_out = 0x7fee57a3d10	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFWndProc, address_out = 0x7fee57a6d30	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFCreateITFCHwnd, address_out = 0x7fee57a3d40	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoDestroyITFC, address_out = 0x7fee57ae6f0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFPitbsFromHwndAndMsg, address_out = 0x7fee57adf40	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFGetComponentManager, address_out = 0x7fee57a7bf0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoMultiByteToWideChar, address_out = 0x7fee57afcd0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoWideCharToMultiByte, address_out = 0x7fee57a8b20	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoHrRegisterAll, address_out = 0x7fee58a2ef0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFSetComponentManager, address_out = 0x7fee57b42c0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFCreateStdComponentManager, address_out = 0x7fee57a3e20	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFHandledMessageNeeded, address_out = 0x7fee57aab10	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoPeekMessage, address_out = 0x7fee57aa7d0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFCreateIPref, address_out = 0x7fee57a1550	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoDestroyIPref, address_out = 0x7fee57ae830	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoChsFromLid, address_out = 0x7fee57a13d0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoCpgFromChs, address_out = 0x7fee57a6660	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoSetLocale, address_out = 0x7fee57a1500	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoFSetHMsoinstOfSdm, address_out = 0x7fee57a3dd0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoSetVbaInterfaces, address_out = 0x7fee58a71e0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MsoGetControlInstanceId, address_out = 0x7fee5876d10	1	Fn
Module	Get Address	module_name = Unknown module name, function = VbeuiFIsEdpEnabled, address_out = 0x7fee58e98e0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VbeuiEnterpriseProtect, address_out = 0x7fee58e9830	1	Fn
Environment	Get Environment String	name = DDRYBUR	1	Fn
Module	Get Filename	process_name = c:\program files\microsoft office\root\office16\excel.exe, file_name_orig = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL, size = 260	1	Fn
Module	Load	module_name = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL.DLL, base_address = 0x7fee6110000	1	Fn
Module	Get Filename	process_name = c:\program files\microsoft office\root\office16\excel.exe, file_name_orig = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL, size = 260	1	Fn
System	Get Info	type = Operating System	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\Licenses	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7, data = }	1	Fn
Module	Load	module_name = OLEAUT32.DLL, base_address = 0x7feff380000	1	Fn
Module	Get Address	module_name = Unknown module name, function = SysFreeString, address_out = 0x7feff381320	1	Fn
Module	Get Address	module_name = Unknown module name, function = LoadTypeLib, address_out = 0x7feff38f1e0	1	Fn
Module	Get Address	module_name = Unknown module name, function = RegisterTypeLib, address_out = 0x7feff3dcaa0	1	Fn
Module	Get Address	module_name = Unknown module name, function = QueryPathOfRegTypeLib, address_out = 0x7feff411760	1	Fn
Module	Get Address	module_name = Unknown module name, function = UnRegisterTypeLib, address_out = 0x7feff4120d0	1	Fn
Module	Get Address	module_name = Unknown module name, function = OleTranslateColor, address_out = 0x7feff3ac760	1	Fn
Module	Get Address	module_name = Unknown module name, function = OleCreateFontIndirect, address_out = 0x7feff3decd0	1	Fn
Module	Get Address	module_name = Unknown module name, function = OleCreatePictureIndirect, address_out = 0x7feff3de840	1	Fn
Module	Get Address	module_name = Unknown module name, function = OleLoadPicture, address_out = 0x7feff3ef420	1	Fn
Module	Get Address	module_name = Unknown module name, function = OleCreatePropertyFrameIndirect, address_out = 0x7feff3e4ec0	1	Fn
Module	Get Address	module_name = Unknown module name, function = OleCreatePropertyFrame, address_out = 0x7feff3e9350	1	Fn
Module	Get Address	module_name = Unknown module name, function = OleIconToCursor, address_out = 0x7feff3b6e40	1	Fn
Module	Get Address	module_name = Unknown module name, function = LoadTypeLibEx, address_out = 0x7feff38a550	1	Fn
Module	Get Address	module_name = Unknown module name, function = OleLoadPictureEx, address_out = 0x7feff3ef320	1	Fn
Window	Create	class_name = ThunderMain, wndproc_parameter = 0	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = USER32, base_address = 0x774e0000	1	Fn
Module	Get Address	module_name = Unknown module name, function = GetSystemMetrics, address_out = 0x774f94f0	1	Fn
Module	Get Address	module_name = Unknown module name, function = MonitorFromWindow, address_out = 0x774f5f08	1	Fn
Module	Get Address	module_name = Unknown module name, function = MonitorFromRect, address_out = 0x774f2b00	1	Fn
Module	Get Address	module_name = Unknown module name, function = MonitorFromPoint, address_out = 0x774eab64	1	Fn
Module	Get Address	module_name = Unknown module name, function = EnumDisplayMonitors, address_out = 0x774f5c30	1	Fn
Module	Get Address	module_name = Unknown module name, function = GetMonitorInfoA, address_out = 0x774ea730	1	Fn
Module	Get Address	module_name = Unknown module name, function = EnumDisplayDevicesA, address_out = 0x774ea5b4	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = oleaut32.dll, base_address = 0x7feff380000	1	Fn
Module	Get Address	module_name = Unknown module name, function = DispCallFunc, address_out = 0x7feff382270	1	Fn
Module	Get Address	module_name = Unknown module name, function = LoadTypeLibEx, address_out = 0x7feff38a550	1	Fn
Module	Get Address	module_name = Unknown module name, function = UnRegisterTypeLib, address_out = 0x7feff4120d0	1	Fn
Module	Get Address	module_name = Unknown module name, function = CreateTypeLib2, address_out = 0x7feff40dbd0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDateFromUdate, address_out = 0x7feff385c90	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarUdateFromDate, address_out = 0x7feff386330	1	Fn
Module	Get Address	module_name = Unknown module name, function = GetAltMonthNames, address_out = 0x7feff3a66c0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarNumFromParseNum, address_out = 0x7feff384710	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarParseNumFromStr, address_out = 0x7feff3848f0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDecFromR4, address_out = 0x7feff3bb640	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDecFromR8, address_out = 0x7feff3bb360	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDecFromDate, address_out = 0x7feff3c2640	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDecFromI4, address_out = 0x7feff3a58a0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDecFromCy, address_out = 0x7feff3a5820	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarR4FromDec, address_out = 0x7feff3baf20	1	Fn
Module	Get Address	module_name = Unknown module name, function = GetRecordInfoFromTypeInfo, address_out = 0x7feff3da0c0	1	Fn
Module	Get Address	module_name = Unknown module name, function = GetRecordInfoFromGuids, address_out = 0x7feff412160	1	Fn
Module	Get Address	module_name = Unknown module name, function = SafeArrayGetRecordInfo, address_out = 0x7feff3a5af0	1	Fn
Module	Get Address	module_name = Unknown module name, function = SafeArraySetRecordInfo, address_out = 0x7feff3a5a90	1	Fn
Module	Get Address	module_name = Unknown module name, function = SafeArrayGetIID, address_out = 0x7feff3a5a60	1	Fn
Module	Get Address	module_name = Unknown module name, function = SafeArraySetIID, address_out = 0x7feff3a5a30	1	Fn
Module	Get Address	module_name = Unknown module name, function = SafeArrayCopyData, address_out = 0x7feff3860b0	1	Fn
Module	Get Address	module_name = Unknown module name, function = SafeArrayAllocDescriptorEx, address_out = 0x7feff383e90	1	Fn
Module	Get Address	module_name = Unknown module name, function = SafeArrayCreateEx, address_out = 0x7feff3d9f80	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarFormat, address_out = 0x7feff409b20	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarFormatDateTime, address_out = 0x7feff409aa0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarFormatNumber, address_out = 0x7feff409990	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarFormatPercent, address_out = 0x7feff409890	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarFormatCurrency, address_out = 0x7feff409770	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarWeekdayName, address_out = 0x7feff3eb8d0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarMonthName, address_out = 0x7feff3eb800	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarAdd, address_out = 0x7feff4048e0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarAnd, address_out = 0x7feff409470	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarCat, address_out = 0x7feff4096a0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDiv, address_out = 0x7feff402fe0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarEqv, address_out = 0x7feff409cf0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarIdiv, address_out = 0x7feff408ff0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarImp, address_out = 0x7feff409c00	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarMod, address_out = 0x7feff408e60	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarMul, address_out = 0x7feff403690	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarOr, address_out = 0x7feff4092d0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarPow, address_out = 0x7feff402e80	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarSub, address_out = 0x7feff403f90	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarXor, address_out = 0x7feff4091a0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarAbs, address_out = 0x7feff3e7c30	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarFix, address_out = 0x7feff3e7a60	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarInt, address_out = 0x7feff3e7890	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarNeg, address_out = 0x7feff3e7ea0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarNot, address_out = 0x7feff409600	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarRound, address_out = 0x7feff3e76a0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarCmp, address_out = 0x7feff4083f0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDecAdd, address_out = 0x7feff3b3070	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarDecCmp, address_out = 0x7feff3bd700	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarBstrCat, address_out = 0x7feff3bd890	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarCyMulI4, address_out = 0x7feff39caf0	1	Fn
Module	Get Address	module_name = Unknown module name, function = VarBstrCmp, address_out = 0x7feff3a8a00	1	Fn
System	Get Time	type = Local Time, time = 2019-02-17 13:35:05 (Local Time)	2	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = RequireDeclaration, data = 145, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = CompileOnDemand, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = NotifyUserBeforeStateLoss, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BackGroundCompile, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BreakOnAllErrors, data = 255, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BreakOnServerErrors, data = 0, type = REG_NONE	1	Fn
Module	Get Address	module_name = Unknown module name, address_out = 0x7fee57afcd0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\409	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\9	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0\win64	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0\win64, data = C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE	1	Fn
Module	Get Filename	process_name = c:\program files\microsoft office\root\office16\excel.exe, file_name_orig = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL, size = 260	1	Fn
Module	Get Address	module_name = Unknown module name, address_out = 0x0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64, data = C:\Windows\system32\stdole2.tlb	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64, data = C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0\win64	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0\win32	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0\win64, data = 챀ದ	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0\win32, data = C:\Windows\System32\msxml6.dll	1	Fn
System	Get Time	type = Local Time, time = 2019-02-17 13:35:05 (Local Time)	2	Fn
System	Get Cursor	x_out = 568, y_out = 449	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = VbaCapability, data = 112	1	Fn
System	Get Time	type = Local Time, time = 2019-02-17 13:35:05 (Local Time)	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 626, address_out = 0x7fee5d82a80	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 556, address_out = 0x7fee5bab298	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 560, address_out = 0x7fee5bab3e8	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 710, address_out = 0x7fee5dc993c	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 631, address_out = 0x7fee5bad690	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 581, address_out = 0x7fee5baa6c8	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 537, address_out = 0x7fee5baad64	1	Fn
System	Get Time	type = System Time, time = 2019-02-17 13:35:06 (UTC)	1	Fn
System	Get Time	type = Ticks, time = 108857	1	Fn
System	Get Info	type = Operating System	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting, value_name = Default Impersonation Level, data = 3	1	Fn
System	Get Info	type = System Directory, result_out = C:\Windows\system32	1	Fn
Module	Load	module_name = C:\Windows\system32\advapi32.dll, base_address = 0x7fefed90000	1	Fn
Module	Get Address	module_name = Unknown module name, function = DuplicateTokenEx, address_out = 0x7fefed9d310	1	Fn
COM	Create	interface = DC12A687-737F-11CF-884D-00AA004B2E24, cls_context = CLSCTX_INPROC_SERVER	1	Fn
COM	Create	interface = 3BC15AF2-736C-477E-9E51-238AF8667DCC, cls_context = CLSCTX_INPROC_SERVER	3	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	4	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 716, address_out = 0x7fee5d824c8	1	Fn
COM	Create	interface = 00000000-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER	1	Fn
Inet	Open Session	user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729), access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS	1	Fn
Inet	Open Connection	protocol = https, server_name = www.mertsarica.com, server_port = 443	1	Fn
Inet	Open HTTP Request	http_verb = POST, http_version = HTTP 1.1, target_resource = /macro.php	1	Fn
Inet	Send HTTP Request	url = https://www.mertsarica.com/macro.php	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 717, address_out = 0x7fee5da48e0	1	Fn
Inet	Send HTTP Request	url = https://www.mertsarica.com/macro.php	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
System	Get Cursor	x_out = 1151, y_out = 371	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Module	Load	module_name = ADVAPI32.DLL, base_address = 0x7fefed90000	1	Fn
Module	Get Address	module_name = Unknown module name, function = CryptAcquireContextA, address_out = 0x7fefed98180	1	Fn
Module	Get Address	module_name = Unknown module name, function = CryptCreateHash, address_out = 0x7fefed9dad4	1	Fn
Module	Get Address	module_name = Unknown module name, function = CryptDestroyHash, address_out = 0x7fefed9db00	1	Fn
Module	Get Address	module_name = Unknown module name, function = CryptHashData, address_out = 0x7fefed9dac0	1	Fn
Module	Get Address	module_name = Unknown module name, function = CryptGetHashParam, address_out = 0x7fefed9db20	1	Fn
Module	Get Address	module_name = Unknown module name, function = CryptReleaseContext, address_out = 0x7fefed9dd10	1	Fn
Module	Get Address	module_name = Unknown module name, function = CryptGenRandom, address_out = 0x7fefed9dc60	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64, data = C:\Windows\system32\stdole2.tlb	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64, data = C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}	1	Fn
Registry	Enumerate Keys	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0\win64	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0\win32	1	Fn
Registry	Open Key	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0\win64, data =	1	Fn
Registry	Read Value	reg_name = HKEY_CLASSES_ROOT\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\6.0\0\win32, data = C:\Windows\System32\msxml6.dll	1	Fn
System	Get Time	type = Ticks, time = 279709	9	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 626, address_out = 0x7fee5d82a80	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 556, address_out = 0x7fee5bab298	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 560, address_out = 0x7fee5bab3e8	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 710, address_out = 0x7fee5dc993c	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 631, address_out = 0x7fee5bad690	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 581, address_out = 0x7fee5baa6c8	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 537, address_out = 0x7fee5baad64	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 716, address_out = 0x7fee5d824c8	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 717, address_out = 0x7fee5da48e0	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 626, address_out = 0x7fee5d82a80	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 556, address_out = 0x7fee5bab298	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 560, address_out = 0x7fee5bab3e8	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 710, address_out = 0x7fee5dc993c	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 631, address_out = 0x7fee5bad690	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 581, address_out = 0x7fee5baa6c8	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 537, address_out = 0x7fee5baad64	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 716, address_out = 0x7fee5d824c8	1	Fn
Module	Load	module_name = VBE7.DLL, base_address = 0x7fee5a40000	1	Fn
Module	Get Address	module_name = Unknown module name, function = 717, address_out = 0x7fee5da48e0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn
Keyboard	Read	virtual_key_code = VK_ESCAPE, result_out = 0	1	Fn

Process #2: svchost.exe

0

»

Information	Value
ID	#2
File Name	c:\windows\system32\svchost.exe
Command Line	C:\Windows\system32\svchost.exe -k netsvcs
Initial Working Directory	C:\Windows\system32\
Monitor	Start Time: 00:00:40, Reason: RPC Server
Unmonitor	End Time: 00:04:34, Reason: Terminated by Timeout
Monitor Duration	00:03:54
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x368
Parent PID	0x1d4 (c:\windows\system32\services.exe)
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs	0x 768 0x 440 0x 578 0x 764 0x 6D4 0x 660 0x 370 0x 330 0x 184 0x 554 0x 568 0x 420 0x 7E4 0x 7DC 0x 7D8 0x 7D4 0x 784 0x 75C 0x 748 0x 744 0x 738 0x 728 0x 724 0x 71C 0x 700 0x 6FC 0x 6F4 0x 6A8 0x 4C4 0x 488 0x 47C 0x 478 0x 458 0x 444 0x 30C 0x 294 0x 1E0 0x 3F8 0x 3EC 0x 3E0 0x 388 0x 384 0x 380 0x 37C 0x 374 0x 36C 0x B30 0x B5C 0x B60 0x 320 0x 808 0x 818 0x 828 0x 838 0x 848 0x 668 0x 884 0x 8AC 0x 8A0 0x 89C 0x 584 0x A8C 0x 870 0x 874 0x 2AC 0x 114 0x 480 0x 23C 0x 44C 0x 834 0x 844 0x 854 0x 868 0x 888 0x 74C 0x 2EC 0x C4 0x B94 0x 248 0x 944 0x 814

Region

»

Name	Start VA	End VA	Type	Permissions	Actions
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	rw	-
pagefile_0x0000000000020000	0x00020000	0x00026fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	r	-
private_0x0000000000050000	0x00050000	0x0014ffff	Private Memory	rw	-
locale.nls	0x00150000	0x001b6fff	Memory Mapped File	r	-
pagefile_0x00000000001c0000	0x001c0000	0x001c1fff	Pagefile Backed Memory	rw	-
private_0x00000000001d0000	0x001d0000	0x0024ffff	Private Memory	rw	-
private_0x0000000000250000	0x00250000	0x00250fff	Private Memory	rw	-
private_0x0000000000260000	0x00260000	0x00260fff	Private Memory	rw	-
pagefile_0x0000000000270000	0x00270000	0x00270fff	Pagefile Backed Memory	r	-
private_0x0000000000280000	0x00280000	0x0028ffff	Private Memory	rw	-
private_0x0000000000290000	0x00290000	0x0038ffff	Private Memory	rw	-
pagefile_0x0000000000390000	0x00390000	0x00517fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000520000	0x00520000	0x006a0fff	Pagefile Backed Memory	r	-
pagefile_0x00000000006b0000	0x006b0000	0x0076ffff	Pagefile Backed Memory	r	-
pagefile_0x0000000000770000	0x00770000	0x00b62fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000b70000	0x00b70000	0x00b70fff	Pagefile Backed Memory	rw	-
pagefile_0x0000000000b80000	0x00b80000	0x00b80fff	Pagefile Backed Memory	r	-
private_0x0000000000b90000	0x00b90000	0x00b90fff	Private Memory	rw	-
pagefile_0x0000000000ba0000	0x00ba0000	0x00ba1fff	Pagefile Backed Memory	r	-
cversions.2.db	0x00bb0000	0x00bb3fff	Memory Mapped File	r	-
pagefile_0x0000000000bc0000	0x00bc0000	0x00bc1fff	Pagefile Backed Memory	r	-
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db	0x00bd0000	0x00bfffff	Memory Mapped File	r	-
cversions.2.db	0x00c00000	0x00c03fff	Memory Mapped File	r	-
private_0x0000000000c10000	0x00c10000	0x00c8ffff	Private Memory	rw	-
pagefile_0x0000000000c90000	0x00c90000	0x00c90fff	Pagefile Backed Memory	rw	-
firewallapi.dll.mui	0x00ca0000	0x00cbbfff	Memory Mapped File	rw	-
pagefile_0x0000000000cc0000	0x00cc0000	0x00cc0fff	Pagefile Backed Memory	r	-
private_0x0000000000ce0000	0x00ce0000	0x00d5ffff	Private Memory	rw	-
private_0x0000000000d60000	0x00d60000	0x00ddffff	Private Memory	rw	-
private_0x0000000000de0000	0x00de0000	0x00e5ffff	Private Memory	rw	-
private_0x0000000000e60000	0x00e60000	0x00edffff	Private Memory	rw	-
private_0x0000000000ef0000	0x00ef0000	0x00f6ffff	Private Memory	rw	-
private_0x0000000000f80000	0x00f80000	0x00ffffff	Private Memory	rw	-
private_0x0000000001000000	0x01000000	0x0107ffff	Private Memory	rw	-
sortdefault.nls	0x01080000	0x0134efff	Memory Mapped File	r	-
private_0x0000000001360000	0x01360000	0x013dffff	Private Memory	rw	-
private_0x00000000013f0000	0x013f0000	0x0146ffff	Private Memory	rw	-
private_0x0000000001480000	0x01480000	0x0148ffff	Private Memory	rw	-
private_0x00000000014a0000	0x014a0000	0x0151ffff	Private Memory	rw	-
private_0x0000000001540000	0x01540000	0x015bffff	Private Memory	rw	-
private_0x00000000015f0000	0x015f0000	0x0166ffff	Private Memory	rw	-
private_0x0000000001680000	0x01680000	0x016fffff	Private Memory	rw	-
private_0x0000000001750000	0x01750000	0x017cffff	Private Memory	rw	-
private_0x0000000001800000	0x01800000	0x0187ffff	Private Memory	rw	-
private_0x00000000018b0000	0x018b0000	0x0192ffff	Private Memory	rw	-
private_0x0000000001980000	0x01980000	0x019fffff	Private Memory	rw	-
private_0x0000000001a20000	0x01a20000	0x01a9ffff	Private Memory	rw	-
private_0x0000000001aa0000	0x01aa0000	0x01b9ffff	Private Memory	rw	-
private_0x0000000001ba0000	0x01ba0000	0x01c1ffff	Private Memory	rw	-
private_0x0000000001c30000	0x01c30000	0x01caffff	Private Memory	rw	-
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db	0x01cb0000	0x01d15fff	Memory Mapped File	r	-
private_0x0000000001d80000	0x01d80000	0x01dfffff	Private Memory	rw	-
private_0x0000000001e70000	0x01e70000	0x01e7ffff	Private Memory	rw	-
pagefile_0x0000000001e80000	0x01e80000	0x021c2fff	Pagefile Backed Memory	r	-
private_0x00000000021d0000	0x021d0000	0x022cffff	Private Memory	rw	-
private_0x00000000022d0000	0x022d0000	0x0234ffff	Private Memory	rw	-
private_0x0000000002380000	0x02380000	0x023fffff	Private Memory	rw	-
private_0x0000000002400000	0x02400000	0x0247ffff	Private Memory	rw	-
private_0x00000000024a0000	0x024a0000	0x0251ffff	Private Memory	rw	-
private_0x0000000002550000	0x02550000	0x0255ffff	Private Memory	rw	-
private_0x00000000025a0000	0x025a0000	0x0261ffff	Private Memory	rw	-
private_0x0000000002660000	0x02660000	0x026dffff	Private Memory	rw	-
private_0x0000000002720000	0x02720000	0x0279ffff	Private Memory	rw	-
private_0x0000000002830000	0x02830000	0x028affff	Private Memory	rw	-
private_0x0000000002910000	0x02910000	0x0298ffff	Private Memory	rw	-
private_0x00000000029f0000	0x029f0000	0x02a6ffff	Private Memory	rw	-
private_0x0000000002b20000	0x02b20000	0x02b9ffff	Private Memory	rw	-
private_0x0000000002bb0000	0x02bb0000	0x02bbffff	Private Memory	rw	-
private_0x0000000002c60000	0x02c60000	0x02d5ffff	Private Memory	rw	-
private_0x0000000002d60000	0x02d60000	0x02ddffff	Private Memory	rw	-
private_0x0000000002e60000	0x02e60000	0x02f5ffff	Private Memory	rw	-
private_0x0000000003010000	0x03010000	0x0308ffff	Private Memory	rw	-
private_0x00000000030c0000	0x030c0000	0x0313ffff	Private Memory	rw	-
private_0x0000000003140000	0x03140000	0x031bffff	Private Memory	rw	-
private_0x00000000031c0000	0x031c0000	0x0323ffff	Private Memory	rw	-
private_0x0000000003240000	0x03240000	0x032bffff	Private Memory	rw	-
private_0x00000000032e0000	0x032e0000	0x0335ffff	Private Memory	rw	-
private_0x0000000003360000	0x03360000	0x0345ffff	Private Memory	rw	-
private_0x00000000034a0000	0x034a0000	0x0351ffff	Private Memory	rw	-
private_0x00000000035d0000	0x035d0000	0x0364ffff	Private Memory	rw	-
private_0x00000000036b0000	0x036b0000	0x0372ffff	Private Memory	rw	-
private_0x00000000037c0000	0x037c0000	0x0383ffff	Private Memory	rw	-
private_0x0000000003940000	0x03940000	0x03b3ffff	Private Memory	rw	-
private_0x0000000003ba0000	0x03ba0000	0x03c1ffff	Private Memory	rw	-
private_0x0000000003ca0000	0x03ca0000	0x03d1ffff	Private Memory	rw	-
private_0x0000000003d80000	0x03d80000	0x03dfffff	Private Memory	rw	-
private_0x0000000003e60000	0x03e60000	0x03edffff	Private Memory	rw	-
private_0x0000000003f60000	0x03f60000	0x03fdffff	Private Memory	rw	-
private_0x0000000003fe0000	0x03fe0000	0x0405ffff	Private Memory	rw	-
private_0x0000000004070000	0x04070000	0x040effff	Private Memory	rw	-
private_0x0000000004110000	0x04110000	0x0418ffff	Private Memory	rw	-
private_0x0000000004210000	0x04210000	0x0428ffff	Private Memory	rw	-
private_0x00000000042a0000	0x042a0000	0x0431ffff	Private Memory	rw	-
private_0x0000000004360000	0x04360000	0x043dffff	Private Memory	rw	-
pagefile_0x00000000043e0000	0x043e0000	0x044dffff	Pagefile Backed Memory	rw	-
private_0x00000000045c0000	0x045c0000	0x0463ffff	Private Memory	rw	-
private_0x0000000004830000	0x04830000	0x048affff	Private Memory	rw	-
kernel32.dll	0x773c0000	0x774defff	Memory Mapped File	rwx	-
user32.dll	0x774e0000	0x775d9fff	Memory Mapped File	rwx	-
ntdll.dll	0x775e0000	0x77788fff	Memory Mapped File	rwx	-
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	r	-
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	r	-
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	r	-
svchost.exe	0xffaa0000	0xffaaafff	Memory Mapped File	rwx	-
npmproxy.dll	0x7fef5270000	0x7fef527bfff	Memory Mapped File	rwx	-
rasadhlp.dll	0x7fef53d0000	0x7fef53d7fff	Memory Mapped File	rwx	-
tcpipcfg.dll	0x7fef53e0000	0x7fef5421fff	Memory Mapped File	rwx	-
mprapi.dll	0x7fef5430000	0x7fef5469fff	Memory Mapped File	rwx	-
rascfg.dll	0x7fef5470000	0x7fef5489fff	Memory Mapped File	rwx	-
ndiscapcfg.dll	0x7fef5490000	0x7fef549efff	Memory Mapped File	rwx	-
hnetcfg.dll	0x7fef54a0000	0x7fef550afff	Memory Mapped File	rwx	-
resutils.dll	0x7fef5510000	0x7fef5528fff	Memory Mapped File	rwx	-
clusapi.dll	0x7fef5530000	0x7fef557ffff	Memory Mapped File	rwx	-
wbemess.dll	0x7fef55b0000	0x7fef562dfff	Memory Mapped File	rwx	-
ncobjapi.dll	0x7fef5630000	0x7fef5645fff	Memory Mapped File	rwx	-
wmiprvsd.dll	0x7fef5650000	0x7fef570bfff	Memory Mapped File	rwx	-
repdrvfs.dll	0x7fef5710000	0x7fef5782fff	Memory Mapped File	rwx	-
wmiutils.dll	0x7fef5790000	0x7fef57b5fff	Memory Mapped File	rwx	-
nci.dll	0x7fef57c0000	0x7fef57d9fff	Memory Mapped File	rwx	-
netcfgx.dll	0x7fef57e0000	0x7fef5863fff	Memory Mapped File	rwx	-
browser.dll	0x7fef5870000	0x7fef5894fff	Memory Mapped File	rwx	-
wbemcore.dll	0x7fef58a0000	0x7fef59cefff	Memory Mapped File	rwx	-
wdscore.dll	0x7fef59d0000	0x7fef5a16fff	Memory Mapped File	rwx	-
sqmapi.dll	0x7fef5a20000	0x7fef5a61fff	Memory Mapped File	rwx	-
iphlpsvc.dll	0x7fef5a70000	0x7fef5b01fff	Memory Mapped File	rwx	-
wbemcomn.dll	0x7fef5e10000	0x7fef5e95fff	Memory Mapped File	rwx	-
wmisvc.dll	0x7fef5ea0000	0x7fef5edffff	Memory Mapped File	rwx	-
tschannel.dll	0x7fef60c0000	0x7fef60c8fff	Memory Mapped File	rwx	-
vsstrace.dll	0x7fef65d0000	0x7fef65e6fff	Memory Mapped File	rwx	-
vssapi.dll	0x7fef65f0000	0x7fef679ffff	Memory Mapped File	rwx	-
netprofm.dll	0x7fef67d0000	0x7fef6843fff	Memory Mapped File	rwx	-
actxprxy.dll	0x7fef8830000	0x7fef891dfff	Memory Mapped File	rwx	-
taskcomp.dll	0x7fef8df0000	0x7fef8e66fff	Memory Mapped File	rwx	-
ktmw32.dll	0x7fefa810000	0x7fefa819fff	Memory Mapped File	rwx	-
schedsvc.dll	0x7fefa820000	0x7fefa931fff	Memory Mapped File	rwx	-
wiarpc.dll	0x7fefac60000	0x7fefac6efff	Memory Mapped File	rwx	-
fvecerts.dll	0x7fefac70000	0x7fefac78fff	Memory Mapped File	rwx	-
tbs.dll	0x7fefac80000	0x7fefac88fff	Memory Mapped File	rwx	-
fveapi.dll	0x7fefac90000	0x7feface5fff	Memory Mapped File	rwx	-
shsvcs.dll	0x7fefacf0000	0x7fefad4dfff	Memory Mapped File	rwx	-
dhcpcsvc.dll	0x7fefad50000	0x7fefad67fff	Memory Mapped File	rwx	-
dhcpcsvc6.dll	0x7fefad70000	0x7fefad80fff	Memory Mapped File	rwx	-
fwpuclnt.dll	0x7fefae80000	0x7fefaed2fff	Memory Mapped File	rwx	-
winnsi.dll	0x7fefaff0000	0x7fefaffafff	Memory Mapped File	rwx	-
iphlpapi.dll	0x7fefb000000	0x7fefb026fff	Memory Mapped File	rwx	-
sens.dll	0x7fefb030000	0x7fefb043fff	Memory Mapped File	rwx	-
es.dll	0x7fefb060000	0x7fefb0c6fff	Memory Mapped File	rwx	-
slc.dll	0x7fefb0d0000	0x7fefb0dafff	Memory Mapped File	rwx	-
For performance reasons, the remaining 241 entries are omitted. The remaining entries can be found in flog.txt.

Process #4: wmiprvse.exe

0

»

Information	Value
ID	#4
File Name	c:\windows\system32\wbem\wmiprvse.exe
Command Line	C:\Windows\system32\wbem\wmiprvse.exe -Embedding
Initial Working Directory	C:\Windows\system32\
Monitor	Start Time: 00:00:47, Reason: RPC Server
Unmonitor	End Time: 00:02:12, Reason: Self Terminated
Monitor Duration	00:01:25
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xb64
Parent PID	0x254 (c:\windows\system32\svchost.exe)
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs	0x B68 0x B6C 0x B70 0x B74 0x B78 0x B7C 0x B80 0x B84 0x B88 0x B8C 0x B90 0x B94 0x BC8 0x BCC 0x BD0 0x BD4 0x BD8 0x BDC 0x BE0 0x BE4 0x BE8 0x BEC 0x BF0 0x BF8 0x 6BC 0x 880 0x 87C 0x 878 0x 8B8 0x 3BC 0x 3AC 0x 780 0x 2B0 0x 6F8 0x 708 0x 7A4 0x 7B4 0x 760 0x 85C 0x 8C4 0x 8C0 0x 898 0x 474 0x 570 0x 8F8 0x 8FC 0x 894 0x 4F4 0x 914 0x 91C 0x 920 0x 918 0x 910 0x 90C 0x 908 0x 904 0x 8D4 0x 8D0 0x 8CC 0x 288 0x 640 0x 878

Region

»

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	rw	-
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	rw	-
private_0x0000000000020000	0x00020000	0x0002ffff	Private Memory	rw	-
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	r	-
private_0x0000000000050000	0x00050000	0x00050fff	Private Memory	rw	-
private_0x0000000000060000	0x00060000	0x00060fff	Private Memory	rw	-
private_0x0000000000070000	0x00070000	0x000effff	Private Memory	rw	-
locale.nls	0x000f0000	0x00156fff	Memory Mapped File	r	-
private_0x0000000000160000	0x00160000	0x0025ffff	Private Memory	rw	-
private_0x0000000000260000	0x00260000	0x0035ffff	Private Memory	rw	-
pagefile_0x0000000000360000	0x00360000	0x004e7fff	Pagefile Backed Memory	r	-
pagefile_0x00000000004f0000	0x004f0000	0x00670fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000680000	0x00680000	0x0073ffff	Pagefile Backed Memory	r	-
pagefile_0x0000000000740000	0x00740000	0x00746fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000750000	0x00750000	0x00751fff	Pagefile Backed Memory	rw	-
pagefile_0x0000000000760000	0x00760000	0x00760fff	Pagefile Backed Memory	rw	-
pagefile_0x0000000000770000	0x00770000	0x00770fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000780000	0x00780000	0x00780fff	Pagefile Backed Memory	r	-
private_0x0000000000790000	0x00790000	0x0079ffff	Private Memory	rw	-
pagefile_0x00000000007a0000	0x007a0000	0x007a0fff	Pagefile Backed Memory	rw	-
private_0x00000000007b0000	0x007b0000	0x0082ffff	Private Memory	rw	-
private_0x0000000000830000	0x00830000	0x0092ffff	Private Memory	rw	-
private_0x0000000000930000	0x00930000	0x009affff	Private Memory	rw	-
ff3d.msi	0x00930000	0x00953fff	Memory Mapped File	r	-
private_0x00000000009e0000	0x009e0000	0x00a5ffff	Private Memory	rw	-
sortdefault.nls	0x00a60000	0x00d2efff	Memory Mapped File	r	-
pagefile_0x0000000000d30000	0x00d30000	0x01122fff	Pagefile Backed Memory	r	-
private_0x00000000011b0000	0x011b0000	0x0122ffff	Private Memory	rw	-
private_0x0000000001260000	0x01260000	0x012dffff	Private Memory	rw	-
private_0x00000000012e0000	0x012e0000	0x0135ffff	Private Memory	rw	-
private_0x00000000013b0000	0x013b0000	0x0142ffff	Private Memory	rw	-
private_0x0000000001440000	0x01440000	0x014bffff	Private Memory	rw	-
private_0x00000000014f0000	0x014f0000	0x0156ffff	Private Memory	rw	-
private_0x0000000001580000	0x01580000	0x015fffff	Private Memory	rw	-
1bcb9f.msi	0x01600000	0x020b7fff	Memory Mapped File	r	-
private_0x0000000001620000	0x01620000	0x0169ffff	Private Memory	rw	-
1bcb9f.msi	0x016a0000	0x02157fff	Memory Mapped File	r	-
private_0x00000000016a0000	0x016a0000	0x0179ffff	Private Memory	rw	-
private_0x00000000017f0000	0x017f0000	0x017fffff	Private Memory	rw	-
private_0x0000000001800000	0x01800000	0x018fffff	Private Memory	rw	-
private_0x0000000001910000	0x01910000	0x0191ffff	Private Memory	rw	-
private_0x0000000001a20000	0x01a20000	0x01a9ffff	Private Memory	rw	-
private_0x0000000001b60000	0x01b60000	0x01bdffff	Private Memory	rwx	-
private_0x00000000021a0000	0x021a0000	0x021affff	Private Memory	rw	-
private_0x00000000021b0000	0x021b0000	0x022affff	Private Memory	rw	-
private_0x00000000022c0000	0x022c0000	0x0233ffff	Private Memory	rw	-
private_0x00000000023a0000	0x023a0000	0x0241ffff	Private Memory	rw	-
1bcb9f.msi	0x02420000	0x02e1ffff	Memory Mapped File	r	-
private_0x0000000002420000	0x02420000	0x0251ffff	Private Memory	rw	-
private_0x0000000002520000	0x02520000	0x0271ffff	Private Memory	rw	-
private_0x0000000002720000	0x02720000	0x02b1ffff	Private Memory	rw	-
private_0x0000000002b20000	0x02b20000	0x02c1ffff	Private Memory	rw	-
private_0x0000000002cf0000	0x02cf0000	0x02cfffff	Private Memory	rw	-
pagefile_0x0000000002e20000	0x02e20000	0x03162fff	Pagefile Backed Memory	r	-
private_0x0000000003340000	0x03340000	0x033bffff	Private Memory	rwx	-
msimsg.dll	0x75230000	0x75236fff	Memory Mapped File	rwx	-
kernel32.dll	0x773c0000	0x774defff	Memory Mapped File	rwx	-
user32.dll	0x774e0000	0x775d9fff	Memory Mapped File	rwx	-
ntdll.dll	0x775e0000	0x77788fff	Memory Mapped File	rwx	-
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	r	-
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	r	-
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	r	-
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	r	-
wmiprvse.exe	0xff750000	0xff7aefff	Memory Mapped File	rwx	-
msisip.dll	0x7fee53a0000	0x7fee53aafff	Memory Mapped File	rwx	-
msiprov.dll	0x7fee53b0000	0x7fee5414fff	Memory Mapped File	rwx	-
comctl32.dll	0x7fee6da0000	0x7fee6e3ffff	Memory Mapped File	rwx	-
mscoreei.dll	0x7fee94d0000	0x7fee9568fff	Memory Mapped File	rwx	-
mscoree.dll	0x7fee9570000	0x7fee95defff	Memory Mapped File	rwx	-
ncobjapi.dll	0x7fef5630000	0x7fef5645fff	Memory Mapped File	rwx	-
wmiutils.dll	0x7fef5790000	0x7fef57b5fff	Memory Mapped File	rwx	-
wbemcomn.dll	0x7fef5e10000	0x7fef5e95fff	Memory Mapped File	rwx	-
msi.dll	0x7fef9a00000	0x7fef9d15fff	Memory Mapped File	rwx	-
apphelp.dll	0x7fefa5e0000	0x7fefa636fff	Memory Mapped File	rwx	-
ntmarta.dll	0x7fefb4a0000	0x7fefb4ccfff	Memory Mapped File	rwx	-
fastprox.dll	0x7fefb610000	0x7fefb6f1fff	Memory Mapped File	rwx	-
wbemsvc.dll	0x7fefb780000	0x7fefb793fff	Memory Mapped File	rwx	-
ntdsapi.dll	0x7fefb810000	0x7fefb836fff	Memory Mapped File	rwx	-
wbemprox.dll	0x7fefb8a0000	0x7fefb8aefff	Memory Mapped File	rwx	-
version.dll	0x7fefc6f0000	0x7fefc6fbfff	Memory Mapped File	rwx	-
gpapi.dll	0x7fefc8b0000	0x7fefc8cafff	Memory Mapped File	rwx	-
userenv.dll	0x7fefc8d0000	0x7fefc8edfff	Memory Mapped File	rwx	-
bcryptprimitives.dll	0x7fefca60000	0x7fefcaabfff	Memory Mapped File	rwx	-
rsaenh.dll	0x7fefcb20000	0x7fefcb66fff	Memory Mapped File	rwx	-
cryptsp.dll	0x7fefce20000	0x7fefce36fff	Memory Mapped File	rwx	-
bcrypt.dll	0x7fefcf90000	0x7fefcfb1fff	Memory Mapped File	rwx	-
ncrypt.dll	0x7fefcfc0000	0x7fefd00dfff	Memory Mapped File	rwx	-
sspicli.dll	0x7fefd3f0000	0x7fefd414fff	Memory Mapped File	rwx	-
cryptbase.dll	0x7fefd420000	0x7fefd42efff	Memory Mapped File	rwx	-
winsta.dll	0x7fefd4d0000	0x7fefd50cfff	Memory Mapped File	rwx	-
rpcrtremote.dll	0x7fefd510000	0x7fefd523fff	Memory Mapped File	rwx	-
profapi.dll	0x7fefd530000	0x7fefd53efff	Memory Mapped File	rwx	-
msasn1.dll	0x7fefd5d0000	0x7fefd5defff	Memory Mapped File	rwx	-
wintrust.dll	0x7fefd680000	0x7fefd6b9fff	Memory Mapped File	rwx	-
kernelbase.dll	0x7fefd6e0000	0x7fefd74afff	Memory Mapped File	rwx	-
crypt32.dll	0x7fefd750000	0x7fefd8b6fff	Memory Mapped File	rwx	-
ws2_32.dll	0x7fefd900000	0x7fefd94cfff	Memory Mapped File	rwx	-
msctf.dll	0x7fefd970000	0x7fefda78fff	Memory Mapped File	rwx	-
rpcrt4.dll	0x7fefda80000	0x7fefdbacfff	Memory Mapped File	rwx	-
lpk.dll	0x7fefdce0000	0x7fefdcedfff	Memory Mapped File	rwx	-
shlwapi.dll	0x7fefdcf0000	0x7fefdd60fff	Memory Mapped File	rwx	-
usp10.dll	0x7fefdd70000	0x7fefde38fff	Memory Mapped File	rwx	-
nsi.dll	0x7fefde40000	0x7fefde47fff	Memory Mapped File	rwx	-
shell32.dll	0x7fefde50000	0x7fefebd7fff	Memory Mapped File	rwx	-
imm32.dll	0x7fefebe0000	0x7fefec0dfff	Memory Mapped File	rwx	-
advapi32.dll	0x7fefed90000	0x7fefee6afff	Memory Mapped File	rwx	-
ole32.dll	0x7fefee70000	0x7feff072fff	Memory Mapped File	rwx	-
msvcrt.dll	0x7feff2e0000	0x7feff37efff	Memory Mapped File	rwx	-
oleaut32.dll	0x7feff380000	0x7feff456fff	Memory Mapped File	rwx	-
wldap32.dll	0x7feff4e0000	0x7feff531fff	Memory Mapped File	rwx	-
gdi32.dll	0x7feff540000	0x7feff5a6fff	Memory Mapped File	rwx	-
clbcatq.dll	0x7feff5b0000	0x7feff648fff	Memory Mapped File	rwx	-
sechost.dll	0x7feff830000	0x7feff84efff	Memory Mapped File	rwx	-
apisetschema.dll	0x7feff900000	0x7feff900fff	Memory Mapped File	rwx	-
private_0x000007fffffa4000	0x7fffffa4000	0x7fffffa5fff	Private Memory	rw	-
private_0x000007fffffa6000	0x7fffffa6000	0x7fffffa7fff	Private Memory	rw	-
private_0x000007fffffa8000	0x7fffffa8000	0x7fffffa9fff	Private Memory	rw	-
private_0x000007fffffaa000	0x7fffffaa000	0x7fffffabfff	Private Memory	rw	-
private_0x000007fffffac000	0x7fffffac000	0x7fffffadfff	Private Memory	rw	-
private_0x000007fffffae000	0x7fffffae000	0x7fffffaffff	Private Memory	rw	-
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	r	-
private_0x000007fffffd3000	0x7fffffd3000	0x7fffffd4fff	Private Memory	rw	-
private_0x000007fffffd5000	0x7fffffd5000	0x7fffffd6fff	Private Memory	rw	-
private_0x000007fffffd7000	0x7fffffd7000	0x7fffffd8fff	Private Memory	rw	-
private_0x000007fffffd9000	0x7fffffd9000	0x7fffffdafff	Private Memory	rw	-
private_0x000007fffffdb000	0x7fffffdb000	0x7fffffdcfff	Private Memory	rw	-
private_0x000007fffffdd000	0x7fffffdd000	0x7fffffdefff	Private Memory	rw	-
private_0x000007fffffdf000	0x7fffffdf000	0x7fffffdffff	Private Memory	rw	-

Process #5: msiexec.exe

128

0

»

Information	Value
ID	#5
File Name	c:\windows\system32\msiexec.exe
Command Line	C:\Windows\system32\msiexec.exe /V
Initial Working Directory	C:\Windows\system32\
Monitor	Start Time: 00:00:49, Reason: RPC Server
Unmonitor	End Time: 00:04:34, Reason: Terminated by Timeout
Monitor Duration	00:03:45

OS Process Information

»

Information	Value
PID	0xb98
Parent PID	0x1d4 (c:\windows\system32\services.exe)
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSecurityPrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x BC0 0x BBC 0x BB8 0x BB0 0x BAC 0x B9C 0x 3BC

Region

»

Name	Start VA	End VA	Type	Permissions	Actions
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	rw	-
pagefile_0x0000000000020000	0x00020000	0x00026fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000040000	0x00040000	0x00041fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000050000	0x00050000	0x00051fff	Pagefile Backed Memory	rw	-
msiexec.exe.mui	0x00060000	0x00060fff	Memory Mapped File	rw	-
private_0x0000000000070000	0x00070000	0x000effff	Private Memory	rw	-
locale.nls	0x000f0000	0x00156fff	Memory Mapped File	r	-
pagefile_0x0000000000160000	0x00160000	0x0021ffff	Pagefile Backed Memory	r	-
private_0x0000000000220000	0x00220000	0x00220fff	Private Memory	rw	-
private_0x0000000000230000	0x00230000	0x00230fff	Private Memory	rw	-
private_0x0000000000240000	0x00240000	0x0033ffff	Private Memory	rw	-
private_0x0000000000340000	0x00340000	0x0043ffff	Private Memory	rw	-
pagefile_0x0000000000440000	0x00440000	0x00440fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000450000	0x00450000	0x00451fff	Pagefile Backed Memory	r	-
private_0x0000000000500000	0x00500000	0x0050ffff	Private Memory	rw	-
pagefile_0x0000000000510000	0x00510000	0x00697fff	Pagefile Backed Memory	r	-
pagefile_0x00000000006a0000	0x006a0000	0x00820fff	Pagefile Backed Memory	r	-
sortdefault.nls	0x00830000	0x00afefff	Memory Mapped File	r	-
private_0x0000000000b50000	0x00b50000	0x00bcffff	Private Memory	rw	-
private_0x0000000000bd0000	0x00bd0000	0x00c4ffff	Private Memory	rw	-
private_0x0000000000cb0000	0x00cb0000	0x00d2ffff	Private Memory	rw	-
private_0x0000000000ea0000	0x00ea0000	0x00f1ffff	Private Memory	rw	-
private_0x0000000000f70000	0x00f70000	0x00feffff	Private Memory	rw	-
kernel32.dll	0x773c0000	0x774defff	Memory Mapped File	rwx	-
user32.dll	0x774e0000	0x775d9fff	Memory Mapped File	rwx	-
ntdll.dll	0x775e0000	0x77788fff	Memory Mapped File	rwx	-
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	r	-
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	r	-
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	r	-
msiexec.exe	0xffed0000	0xffef3fff	Memory Mapped File	rwx	-
msi.dll	0x7fef9a00000	0x7fef9d15fff	Memory Mapped File	rwx	-
comctl32.dll	0x7fefc030000	0x7fefc223fff	Memory Mapped File	rwx	-
rsaenh.dll	0x7fefcb20000	0x7fefcb66fff	Memory Mapped File	rwx	-
cryptsp.dll	0x7fefce20000	0x7fefce36fff	Memory Mapped File	rwx	-
cryptbase.dll	0x7fefd420000	0x7fefd42efff	Memory Mapped File	rwx	-
rpcrtremote.dll	0x7fefd510000	0x7fefd523fff	Memory Mapped File	rwx	-
kernelbase.dll	0x7fefd6e0000	0x7fefd74afff	Memory Mapped File	rwx	-
msctf.dll	0x7fefd970000	0x7fefda78fff	Memory Mapped File	rwx	-
rpcrt4.dll	0x7fefda80000	0x7fefdbacfff	Memory Mapped File	rwx	-
lpk.dll	0x7fefdce0000	0x7fefdcedfff	Memory Mapped File	rwx	-
shlwapi.dll	0x7fefdcf0000	0x7fefdd60fff	Memory Mapped File	rwx	-
usp10.dll	0x7fefdd70000	0x7fefde38fff	Memory Mapped File	rwx	-
imm32.dll	0x7fefebe0000	0x7fefec0dfff	Memory Mapped File	rwx	-
advapi32.dll	0x7fefed90000	0x7fefee6afff	Memory Mapped File	rwx	-
ole32.dll	0x7fefee70000	0x7feff072fff	Memory Mapped File	rwx	-
msvcrt.dll	0x7feff2e0000	0x7feff37efff	Memory Mapped File	rwx	-
oleaut32.dll	0x7feff380000	0x7feff456fff	Memory Mapped File	rwx	-
gdi32.dll	0x7feff540000	0x7feff5a6fff	Memory Mapped File	rwx	-
clbcatq.dll	0x7feff5b0000	0x7feff648fff	Memory Mapped File	rwx	-
sechost.dll	0x7feff830000	0x7feff84efff	Memory Mapped File	rwx	-
apisetschema.dll	0x7feff900000	0x7feff900fff	Memory Mapped File	rwx	-
private_0x000007fffffae000	0x7fffffae000	0x7fffffaffff	Private Memory	rw	-
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	r	-
private_0x000007fffffd4000	0x7fffffd4000	0x7fffffd5fff	Private Memory	rw	-
private_0x000007fffffd6000	0x7fffffd6000	0x7fffffd7fff	Private Memory	rw	-
private_0x000007fffffd8000	0x7fffffd8000	0x7fffffd8fff	Private Memory	rw	-
private_0x000007fffffda000	0x7fffffda000	0x7fffffdbfff	Private Memory	rw	-
private_0x000007fffffdc000	0x7fffffdc000	0x7fffffddfff	Private Memory	rw	-
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	rw	-

Threads

Thread 0xbb8

99

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	2	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
System	Sleep	duration = -1 (infinite)	1	Fn

Thread 0xbb0

25

0

»

Category	Operation	Information	Success	Count	Logfile
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetWaitableTimer, address_out = 0x773c8890		1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = DllGetClassObject, address_out = 0x7fef9a6ebf8		24	Fn

Thread 0xb9c

4

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn
Module	Load	module_name = Msi.dll, base_address = 0x7fef9a00000	1	Fn
Module	Get Address	module_name = c:\windows\system32\msi.dll, function = QueryInstanceCount, address_out = 0x7fef9a1009c	1	Fn

Monitored Processes

Behavior Information - Sequential View

Before

After