1f0a6c92...919f | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Trojan, Worm

1f0a6c92c237cbf344dedc841259f1da6b2d8742fcafb6926f746a48bbe0919f (SHA256)

%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe

Windows Exe (x86-32)

Created at 2019-01-04 14:38:00

...

Notifications (2/2)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The operating system was rebooted during the analysis.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xaac Analysis Target High (Elevated) %appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe" -
#2 0xac8 Child Process High (Elevated) yfekw5dmgyvjgc.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe" #1
#3 0xad0 Child Process High (Elevated) cmd.exe /c "C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat" #1
#4 0xae4 Child Process High (Elevated) vssadmin.exe delete shadows /all /quiet #2

Behavior Information - Grouped by Category

Process #1: %appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe
10 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:55, Reason: Analysis Target
Unmonitor End Time: 00:02:08, Reason: Self Terminated
Monitor Duration 00:00:13
OS Process Information
»
Information Value
PID 0xaac
Parent PID 0x458 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AB0
0x 0
0x ABC
0x AC0
0x AC4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File rwx False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory r True False False -
private_0x0000000000080000 0x00080000 0x000fffff Private Memory rw True False False -
rsaenh.dll 0x00100000 0x0013bfff Memory Mapped File r False False False -
windowsshell.manifest 0x00100000 0x00100fff Memory Mapped File r False False False -
pagefile_0x0000000000100000 0x00100000 0x00100fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000110000 0x00110000 0x00111fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory r True False False -
cversions.1.db 0x00130000 0x00133fff Memory Mapped File r True False False -
cversions.2.db 0x00130000 0x00133fff Memory Mapped File r True False False -
pagefile_0x0000000000140000 0x00140000 0x00140fff Pagefile Backed Memory rw True False False -
private_0x0000000000150000 0x00150000 0x0018ffff Private Memory rw True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db 0x00190000 0x001aefff Memory Mapped File r True False False -
private_0x00000000001b0000 0x001b0000 0x002affff Private Memory rw True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db 0x002b0000 0x002dffff Memory Mapped File r True False False -
cversions.2.db 0x002e0000 0x002e3fff Memory Mapped File r True False False -
%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe 0x002f0000 0x002f8fff Memory Mapped File rwx True True True
...
pagefile_0x0000000000300000 0x00300000 0x00306fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000310000 0x00310000 0x00311fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000320000 0x00320000 0x00320fff Pagefile Backed Memory rw True False False -
private_0x0000000000360000 0x00360000 0x0045ffff Private Memory rw True False False -
locale.nls 0x00460000 0x004c6fff Memory Mapped File r False False False -
private_0x00000000004f0000 0x004f0000 0x0052ffff Private Memory rw True False False -
private_0x0000000000530000 0x00530000 0x0053ffff Private Memory rw True False False -
pagefile_0x0000000000540000 0x00540000 0x006c7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000006d0000 0x006d0000 0x00850fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000860000 0x00860000 0x01c5ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01c60000 0x01f2efff Memory Mapped File r False False False -
private_0x0000000001f30000 0x01f30000 0x0200ffff Private Memory rw True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01f30000 0x01f95fff Memory Mapped File r True False False -
private_0x0000000001fd0000 0x01fd0000 0x0200ffff Private Memory rw True False False -
pagefile_0x0000000002010000 0x02010000 0x020eefff Pagefile Backed Memory r True False False -
private_0x00000000020f0000 0x020f0000 0x021f0fff Private Memory rw True False False -
private_0x0000000002190000 0x02190000 0x021cffff Private Memory rw True False False -
private_0x00000000021f0000 0x021f0000 0x022effff Private Memory rw True False False -
private_0x00000000022f0000 0x022f0000 0x023f0fff Private Memory rw True False False -
pagefile_0x00000000022f0000 0x022f0000 0x026e2fff Pagefile Backed Memory r True False False -
private_0x00000000026f0000 0x026f0000 0x027f0fff Private Memory rw True False False -
private_0x00000000027a0000 0x027a0000 0x027dffff Private Memory rw True False False -
private_0x00000000028c0000 0x028c0000 0x029bffff Private Memory rw True False False -
private_0x0000000002a80000 0x02a80000 0x02b7ffff Private Memory rw True False False -
uxtheme.dll 0x74d00000 0x74d7ffff Memory Mapped File rwx False False False -
wow64cpu.dll 0x74d90000 0x74d97fff Memory Mapped File rwx False False False -
wow64win.dll 0x74da0000 0x74dfbfff Memory Mapped File rwx False False False -
wow64.dll 0x74e00000 0x74e3efff Memory Mapped File rwx False False False -
shdocvw.dll 0x74ec0000 0x74eedfff Memory Mapped File rwx False False False -
apphelp.dll 0x74ef0000 0x74f3bfff Memory Mapped File rwx False False False -
profapi.dll 0x74f40000 0x74f4afff Memory Mapped File rwx False False False -
ntmarta.dll 0x74f50000 0x74f70fff Memory Mapped File rwx False False False -
comctl32.dll 0x74f80000 0x7511dfff Memory Mapped File rwx False False False -
propsys.dll 0x75120000 0x75214fff Memory Mapped File rwx False False False -
rsaenh.dll 0x75220000 0x7525afff Memory Mapped File rwx False False False -
cryptsp.dll 0x75260000 0x75275fff Memory Mapped File rwx False False False -
mpr.dll 0x75280000 0x75291fff Memory Mapped File rwx False False False -
cryptbase.dll 0x753a0000 0x753abfff Memory Mapped File rwx False False False -
sspicli.dll 0x753b0000 0x7540ffff Memory Mapped File rwx False False False -
usp10.dll 0x75410000 0x754acfff Memory Mapped File rwx False False False -
clbcatq.dll 0x754b0000 0x75532fff Memory Mapped File rwx False False False -
ole32.dll 0x75540000 0x7569bfff Memory Mapped File rwx False False False -
wldap32.dll 0x756a0000 0x756e4fff Memory Mapped File rwx False False False -
user32.dll 0x756f0000 0x757effff Memory Mapped File rwx False False False -
iertutil.dll 0x757f0000 0x759eafff Memory Mapped File rwx False False False -
kernel32.dll 0x75a20000 0x75b2ffff Memory Mapped File rwx False False False -
advapi32.dll 0x75b30000 0x75bcffff Memory Mapped File rwx False False False -
wininet.dll 0x75be0000 0x75cd4fff Memory Mapped File rwx False False False -
shlwapi.dll 0x75ce0000 0x75d36fff Memory Mapped File rwx False False False -
msctf.dll 0x75d40000 0x75e0bfff Memory Mapped File rwx False False False -
devobj.dll 0x75e10000 0x75e21fff Memory Mapped File rwx False False False -
msvcrt.dll 0x75e30000 0x75edbfff Memory Mapped File rwx False False False -
oleaut32.dll 0x75f60000 0x75feefff Memory Mapped File rwx False False False -
setupapi.dll 0x75ff0000 0x7618cfff Memory Mapped File rwx False False False -
crypt32.dll 0x76190000 0x762acfff Memory Mapped File rwx False False False -
sechost.dll 0x762b0000 0x762c8fff Memory Mapped File rwx False False False -
lpk.dll 0x762d0000 0x762d9fff Memory Mapped File rwx False False False -
urlmon.dll 0x762e0000 0x76415fff Memory Mapped File rwx False False False -
imm32.dll 0x76500000 0x7655ffff Memory Mapped File rwx False False False -
kernelbase.dll 0x765f0000 0x76635fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x76640000 0x76666fff Memory Mapped File rwx False False False -
shell32.dll 0x76670000 0x772b9fff Memory Mapped File rwx False False False -
msasn1.dll 0x772c0000 0x772cbfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772d0000 0x773bffff Memory Mapped File rwx False False False -
gdi32.dll 0x773c0000 0x7744ffff Memory Mapped File rwx False False False -
private_0x0000000077450000 0x77450000 0x77549fff Private Memory rwx True False False -
private_0x0000000077550000 0x77550000 0x7766efff Private Memory rwx True False False -
ntdll.dll 0x77670000 0x77818fff Memory Mapped File rwx False False False -
ntdll.dll 0x77850000 0x779cffff Memory Mapped File rwx False False False -
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory rw True False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory r True False False -
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory rw True False False -
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory rw True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory rw True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory rw True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory rw True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory r True False False -
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe 18.00 KB MD5: 5a054e4b94c144afdf259c0ba19d0693
SHA1: 42449f01ac3e9b0676a75d6053ec3a566d6f14a3
SHA256: 1f0a6c92c237cbf344dedc841259f1da6b2d8742fcafb6926f746a48bbe0919f
SSDeep: 384:95/Gu5S5C2js70eOeF5eawczDyhoZhKrbr:9BGX42jsNzNXzDyhoZUrb 		True
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3:: 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat 0.30 KB MD5: 2e83fd14e6b70b3b3b3a7b1c47b2fc1f
SHA1: a60113e1e6be64da73695c5ec56ba9fef1409392
SHA256: 244fe82fa86db3766b8df452f52ecd1c3daf7db51ff8c12315d5477a35aa1a56
SSDeep: 6:hHUTk4FA8y40MhiXoKKWOrIvMD2UUTk4FA8y40MhiXoKKWOrY0/Hm1gfbci23fSD:eT6x40MkXXNOqT6x40MkXXNOM0/Hm+zn 		False
...
Host Behavior
File (4)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create Temp File C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp path = C:\Users\5P5NRG~1\AppData\Local\Temp True 1
Fn
Copy C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe True 1
Fn
Write C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat size = 309 True 1
Fn
Data
Registry (1)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender - False 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe show_window = SW_SHOW True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xad0, creation_flags = CREATE_DEFAULT_ERROR_MODE, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Module (3)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe base_address = 0x2f0000 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, size = 260 True 2
Fn
Process #2: yfekw5dmgyvjgc.exe
2477 0
»
Information Value
ID #2
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\yfekw5dmgyvjgc.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:31, Reason: Self Terminated
Monitor Duration 00:00:25
OS Process Information
»
Information Value
PID 0xac8
Parent PID 0xaac (c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x ACC
0x AF8
0x AFC
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File rwx False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory r True False False -
private_0x0000000000060000 0x00060000 0x0006ffff Private Memory rw True False False -
pagefile_0x0000000000060000 0x00060000 0x00067fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000070000 0x00070000 0x00077fff Pagefile Backed Memory rw True False False -
yfekw5dmgyvjgc.exe 0x00080000 0x00088fff Memory Mapped File rwx True True True
...
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory rw True False False -
locale.nls 0x000f0000 0x00156fff Memory Mapped File r False False False -
rsaenh.dll 0x00160000 0x0019bfff Memory Mapped File r False False False -
private_0x00000000001f0000 0x001f0000 0x0026ffff Private Memory rw True False False -
private_0x0000000000270000 0x00270000 0x002affff Private Memory rw True False False -
private_0x00000000002b0000 0x002b0000 0x003affff Private Memory rw True False False -
private_0x00000000004b0000 0x004b0000 0x005affff Private Memory rw True False False -
pagefile_0x00000000005b0000 0x005b0000 0x00737fff Pagefile Backed Memory r True False False -
private_0x00000000007a0000 0x007a0000 0x007affff Private Memory rw True False False -
pagefile_0x00000000007b0000 0x007b0000 0x00930fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000940000 0x00940000 0x01d3ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01d40000 0x0200efff Memory Mapped File r False False False -
private_0x0000000002080000 0x02080000 0x020bffff Private Memory rw True False False -
private_0x0000000002110000 0x02110000 0x0220ffff Private Memory rw True False False -
private_0x00000000023c0000 0x023c0000 0x024bffff Private Memory rw True False False -
wow64cpu.dll 0x74d90000 0x74d97fff Memory Mapped File rwx False False False -
wow64win.dll 0x74da0000 0x74dfbfff Memory Mapped File rwx False False False -
wow64.dll 0x74e00000 0x74e3efff Memory Mapped File rwx False False False -
rsaenh.dll 0x75200000 0x7523afff Memory Mapped File rwx False False False -
cryptsp.dll 0x75240000 0x75255fff Memory Mapped File rwx False False False -
mpr.dll 0x75280000 0x75291fff Memory Mapped File rwx False False False -
cryptbase.dll 0x753a0000 0x753abfff Memory Mapped File rwx False False False -
sspicli.dll 0x753b0000 0x7540ffff Memory Mapped File rwx False False False -
usp10.dll 0x75410000 0x754acfff Memory Mapped File rwx False False False -
ole32.dll 0x75540000 0x7569bfff Memory Mapped File rwx False False False -
user32.dll 0x756f0000 0x757effff Memory Mapped File rwx False False False -
kernel32.dll 0x75a20000 0x75b2ffff Memory Mapped File rwx False False False -
advapi32.dll 0x75b30000 0x75bcffff Memory Mapped File rwx False False False -
shlwapi.dll 0x75ce0000 0x75d36fff Memory Mapped File rwx False False False -
msctf.dll 0x75d40000 0x75e0bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x75e30000 0x75edbfff Memory Mapped File rwx False False False -
sechost.dll 0x762b0000 0x762c8fff Memory Mapped File rwx False False False -
lpk.dll 0x762d0000 0x762d9fff Memory Mapped File rwx False False False -
imm32.dll 0x76500000 0x7655ffff Memory Mapped File rwx False False False -
kernelbase.dll 0x765f0000 0x76635fff Memory Mapped File rwx False False False -
shell32.dll 0x76670000 0x772b9fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772d0000 0x773bffff Memory Mapped File rwx False False False -
gdi32.dll 0x773c0000 0x7744ffff Memory Mapped File rwx False False False -
private_0x0000000077450000 0x77450000 0x77549fff Private Memory rwx True False False -
private_0x0000000077550000 0x77550000 0x7766efff Private Memory rwx True False False -
ntdll.dll 0x77670000 0x77818fff Memory Mapped File rwx False False False -
ntdll.dll 0x77850000 0x779cffff Memory Mapped File rwx False False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory r True False False -
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory rw True False False -
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory rw True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory rw True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory rw True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory rw True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory r True False False -
Created Files
»
Filename File Size Hash Values YARA Match Actions
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml 2.49 KB MD5: aa24cf4316545a6d76559617d9de4e81
SHA1: 84a8f9ddd37b0b64589418122e3c5af4dc664d33
SHA256: 0b92f62ee86a7acad8e983dfce98bff8297daec0405efdf1942993fe0df0fbd6
SSDeep: 48:uILJqxjAXXwT/n3+rK5ZB7Xr3lGoNBiliZqzKPCsFtV2tM7m:LLwRrXBN73iliUzKZteM6 		False
...
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi 2.39 MB MD5: 86c67c9ce448a0a992cdcd8fd37a227a
SHA1: 34da7b9e555263fabdef2e7388855e6a43d4ef04
SHA256: 674e94ed7e8e1f6381843dd39157b93eab518615362aaf89668caeabbee69d60
SSDeep: 49152:LNIDxihRZ2dfi18m90hzj3ixoUKgjs5oz8+YnFqKyxghZf2rXy9SB44qXcmH:2xihRZ2dfJmOhzDixJLjs5oz8PExAf2U 		False
...
debug.log 7.76 KB MD5: a67db75a1f2f813da54317a661354887
SHA1: b37f2701fc414201a0af34820e6b896c27ef9a75
SHA256: cc4a7f6af53cea59dffde21082d2c7cc3f20c29f98228b43f8c9a4aa1e929355
SSDeep: 96:bGsQaziuw6fc6dZeDmhZKv/MyJ20XUKCr70zZgp7A21aII:1hzLfBvgf 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml 1.78 KB MD5: 221c89a6864b87a80374fa2750031774
SHA1: 8bd11313381e0f6d79fe640c4cf80f2b7c6dd48b
SHA256: 737192827b0ccfcc11cbebe88972f10e3263ef68e360cb7d34ce894634945102
SSDeep: 24:gXQB0Be6MwjtbToCFMt3/Us0mwnkcPWOes5RcU5LZz9ETnyewUgamQJSx6ixRty/:mM6Rjtb0C21HTwnkWRFlhejy+LU6Es 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi 2.39 MB MD5: dfa631eca19d2049def0813c67795367
SHA1: 8d42b115432d3c9d631cb292651b8b94648a5c7f
SHA256: d914b03d007d082875ca7a6c79dace819a099d8785666cb07f122a3a895cf50c
SSDeep: 49152:vNIDxihRZ2dfi18m90hzj3ixoUKgjs5oz8+YnFqKyxghZf2rXy9SB44qXc/Ks/gA:KxihRZ2dfJmOhzDixJLjs5oz8PExAf2X 		False
...
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml 1.67 KB MD5: 33aba5bec1006aaa6e9aa1bee448c5bd
SHA1: a8aa8df1a51297cdabeefb808b9d40501d7cb7ab
SHA256: 11e3ae780ea27b71c9c24130bfbf17718f541e02a7e3245bfbfb03143281fac3
SSDeep: 48:lVF2xoYUc/hZA+Dqssv50zDY8VuHm7Eoa:XAqYUi7U5OY8VuHm4x 		False
...
\\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html 3.80 KB MD5: 2de785d1c95cbccdfa87db48edcb7cae
SHA1: 72b977a464cc16fbe2a2be391b276752353cf009
SHA256: 4f3ace85ad315ccae5a828098d493b65e2ab0b0f9c13d0b0746f1056e7358be1
SSDeep: 48:CF5bDvFKFkDGAyORAeUcnyvUFkUMUW8feeyWe9fZhi3Lhhxmyk4r+yf6HD3MQC:qxDtxyK1Uc/MUW8feiYfZhehG4Jfga 		False
...
\\?\C:\Boot\BCD.LOG1 0.25 KB MD5: 03f18ffb87691417b20dd7ed3c8ff321
SHA1: 2e092399add9b15462b36281860c84f621d9fd16
SHA256: 0fd66a6aa358db1fbc1f659e62fc64ea19ca3e3b5b2983b85cf6c208b9f23c45
SSDeep: 6:xv7ShRLN3HQ7GT6Q+Tfpz+SaXJAMApPCNtFdzGcW+l:xkNAy21LpQ6sN3d6cll 		False
...
\\?\C:\Boot\BOOTSTAT.DAT 64.25 KB MD5: f80b8d8edf9ab436b266c3d91821c102
SHA1: 70075093913574e5ddcaa5671d3a46e85d90013b
SHA256: 49f0fd5d8691008879a85ca4e86d70fe367ece1ce65140eb4e9e552b6c116fe2
SSDeep: 1536:cUhPOcd7UhPOcd7UhPOcd7UhPOcd7UhPOcd7UhPOcd7UhI:cUhPOcFUhPOcFUhPOcFUhPOcFUhPOcF+ 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP 10.00 MB MD5: 15a0fef8a1ade304c039f05a7912fe24
SHA1: 5c75410864654578995e6403198e337ce1eb47fc
SHA256: cf531fd661768bb410cc89b2600c42873ee27fcac66c9e29c717eefd69788299
SSDeep: 196608:kkI0ShKgPbqrX+O+TtdjBU8PMIXiIJ5towFXg2j95eCp:knTK4WrtgBUwUq5mwFg2H7 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab 10.00 MB MD5: f9a8a5aeaa1312e63b4ee59a8d53f748
SHA1: 877e3e73c306afef2bfd8e89ea30ed6de648e710
SHA256: b270b3b867f9fd7ce1dcedd10847f34b06cef027f88790bb56eea61cad0e9db3
SSDeep: 196608:uBT+FUVOwJ4WerdbzDDPMX81eg3hPol9y8mjlnzl7Z7yPpWfQbXa4Fxt5M:V66WuFz/w81nhsFmx5NyxbXDc 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml 2.49 KB MD5: aa24cf4316545a6d76559617d9de4e81
SHA1: 84a8f9ddd37b0b64589418122e3c5af4dc664d33
SHA256: 0b92f62ee86a7acad8e983dfce98bff8297daec0405efdf1942993fe0df0fbd6
SSDeep: 48:uILJqxjAXXwT/n3+rK5ZB7Xr3lGoNBiliZqzKPCsFtV2tM7m:LLwRrXBN73iliUzKZteM6 		False
...
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi 2.39 MB MD5: 86c67c9ce448a0a992cdcd8fd37a227a
SHA1: 34da7b9e555263fabdef2e7388855e6a43d4ef04
SHA256: 674e94ed7e8e1f6381843dd39157b93eab518615362aaf89668caeabbee69d60
SSDeep: 49152:LNIDxihRZ2dfi18m90hzj3ixoUKgjs5oz8+YnFqKyxghZf2rXy9SB44qXcmH:2xihRZ2dfJmOhzDixJLjs5oz8PExAf2U 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml 1.78 KB MD5: 221c89a6864b87a80374fa2750031774
SHA1: 8bd11313381e0f6d79fe640c4cf80f2b7c6dd48b
SHA256: 737192827b0ccfcc11cbebe88972f10e3263ef68e360cb7d34ce894634945102
SSDeep: 24:gXQB0Be6MwjtbToCFMt3/Us0mwnkcPWOes5RcU5LZz9ETnyewUgamQJSx6ixRty/:mM6Rjtb0C21HTwnkWRFlhejy+LU6Es 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi 2.39 MB MD5: dfa631eca19d2049def0813c67795367
SHA1: 8d42b115432d3c9d631cb292651b8b94648a5c7f
SHA256: d914b03d007d082875ca7a6c79dace819a099d8785666cb07f122a3a895cf50c
SSDeep: 49152:vNIDxihRZ2dfi18m90hzj3ixoUKgjs5oz8+YnFqKyxghZf2rXy9SB44qXc/Ks/gA:KxihRZ2dfJmOhzDixJLjs5oz8PExAf2X 		False
...
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml 1.67 KB MD5: 33aba5bec1006aaa6e9aa1bee448c5bd
SHA1: a8aa8df1a51297cdabeefb808b9d40501d7cb7ab
SHA256: 11e3ae780ea27b71c9c24130bfbf17718f541e02a7e3245bfbfb03143281fac3
SSDeep: 48:lVF2xoYUc/hZA+Dqssv50zDY8VuHm7Eoa:XAqYUi7U5OY8VuHm4x 		False
...
\\?\C:\Boot\BCD.LOG1 0.25 KB MD5: 03f18ffb87691417b20dd7ed3c8ff321
SHA1: 2e092399add9b15462b36281860c84f621d9fd16
SHA256: 0fd66a6aa358db1fbc1f659e62fc64ea19ca3e3b5b2983b85cf6c208b9f23c45
SSDeep: 6:xv7ShRLN3HQ7GT6Q+Tfpz+SaXJAMApPCNtFdzGcW+l:xkNAy21LpQ6sN3d6cll 		False
...
\\?\C:\Boot\BOOTSTAT.DAT 64.25 KB MD5: f80b8d8edf9ab436b266c3d91821c102
SHA1: 70075093913574e5ddcaa5671d3a46e85d90013b
SHA256: 49f0fd5d8691008879a85ca4e86d70fe367ece1ce65140eb4e9e552b6c116fe2
SSDeep: 1536:cUhPOcd7UhPOcd7UhPOcd7UhPOcd7UhPOcd7UhPOcd7UhI:cUhPOcFUhPOcFUhPOcFUhPOcFUhPOcF+ 		False
...
Host Behavior
File (2413)
»
Operation Filename Additional Information Success Count Logfile
Create debug.log desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create \\?\C:\Boot\. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\.. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\BCD desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\BCD.LOG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\BCD.LOG1 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\BCD.LOG2 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\en-US\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\en-US\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\es-ES\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\fi-FI\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\Fonts\chs_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\Fonts\cht_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\memtest.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\nb-NO\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\nl-NL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\pl-PL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\pt-BR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\pt-PT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\ru-RU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\sv-SE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\tr-TR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\zh-CN\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\zh-HK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\zh-TW\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Config.Msi\. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Config.Msi\.. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\hiberfil.sys desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\.. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\All Users\. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\All Users\.. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\.. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\$%%! NOTE ABOUT FILES -=!-.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\.. desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Move \\?\C:\Boot\BCD.LOG1_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\Boot\BCD.LOG1 True 1
Fn
Move \\?\C:\Boot\BCD.LOG2_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\Boot\BCD.LOG2 True 1
Fn
Move \\?\C:\Boot\BOOTSTAT.DAT_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\Boot\BOOTSTAT.DAT True 1
Fn
Move \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab True 1
Fn
Move \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi True 1
Fn
Move \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml True 1
Fn
Move \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml True 1
Fn
Move \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi True 1
Fn
Move \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml True 1
Fn
Read \\?\C:\Boot\BCD.LOG1 size = 10240, size_out = 0 True 1
Fn
Read \\?\C:\Boot\BCD.LOG2 size = 10240, size_out = 0 True 1
Fn
Read \\?\C:\Boot\BOOTSTAT.DAT size = 10240, size_out = 10240 True 6
Fn
Data
Read \\?\C:\Boot\BOOTSTAT.DAT size = 10240, size_out = 4096 True 1
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab size = 10240, size_out = 10240 True 249
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi size = 10240, size_out = 10240 True 244
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi size = 10240, size_out = 7680 True 1
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 10240, size_out = 1565 True 1
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml size = 10240, size_out = 2296 True 1
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi size = 10240, size_out = 10240 True 244
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi size = 10240, size_out = 5120 True 1
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml size = 10240, size_out = 1450 True 1
Fn
Data
Read \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab size = 10240, size_out = 10240 True 249
Fn
Data
Write debug.log size = 39 True 1
Fn
Data
Write debug.log size = 45 True 6
Fn
Data
Write debug.log size = 40 True 2
Fn
Data
Write debug.log size = 46 True 5
Fn
Data
Write debug.log size = 41 True 3
Fn
Data
Write debug.log size = 50 True 4
Fn
Data
Write \\?\C:\Boot\BCD.LOG1 size = 0 True 1
Fn
Write \\?\C:\Boot\BCD.LOG1 size = 256 True 1
Fn
Data
Write debug.log size = 38 True 2
Fn
Data
Write \\?\C:\Boot\BCD.LOG2 size = 0 True 1
Fn
Write \\?\C:\Boot\BCD.LOG2 size = 256 True 1
Fn
Data
Write \\?\C:\Boot\BOOTSTAT.DAT size = 10240 True 6
Fn
Data
Write \\?\C:\Boot\BOOTSTAT.DAT size = 4096 True 1
Fn
Data
Write \\?\C:\Boot\BOOTSTAT.DAT size = 256 True 1
Fn
Data
Write debug.log size = 42 True 1
Fn
Data
Write debug.log size = 59 True 25
Fn
Data
Write debug.log size = 63 True 24
Fn
Data
Write \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write debug.log size = 56 True 4
Fn
Data
Write debug.log size = 60 True 5
Fn
Data
Write debug.log size = 57 True 1
Fn
Data
Write debug.log size = 61 True 1
Fn
Data
Write \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write debug.log size = 49 True 3
Fn
Data
Write debug.log size = 53 True 2
Fn
Data
Write \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write debug.log size = 44 True 2
Fn
Data
Write debug.log size = 51 True 1
Fn
Data
Write debug.log size = 52 True 1
Fn
Data
Write \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write debug.log size = 43 True 1
Fn
Data
Write debug.log size = 54 True 1
Fn
Data
Write debug.log size = 94 True 3
Fn
Data
Write debug.log size = 100 True 4
Fn
Data
Write debug.log size = 95 True 2
Fn
Data
Write debug.log size = 101 True 2
Fn
Data
Write debug.log size = 104 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab size = 10240 True 249
Fn
Data
Write debug.log size = 96 True 1
Fn
Data
Write debug.log size = 99 True 1
Fn
Data
Write debug.log size = 105 True 4
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi size = 10240 True 244
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi size = 7680 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi size = 256 True 1
Fn
Data
Write debug.log size = 97 True 3
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 1565 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 256 True 1
Fn
Data
Write debug.log size = 102 True 4
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml size = 2296 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml size = 256 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\$%%! NOTE ABOUT FILES -=!-.html size = 1607 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\$%%! NOTE ABOUT FILES -=!-.html size = 16 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\$%%! NOTE ABOUT FILES -=!-.html size = 1452 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\$%%! NOTE ABOUT FILES -=!-.html size = 17 True 2
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\$%%! NOTE ABOUT FILES -=!-.html size = 98 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\$%%! NOTE ABOUT FILES -=!-.html size = 687 True 1
Fn
Data
Write debug.log size = 110 True 2
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi size = 10240 True 244
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi size = 5120 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi size = 256 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml size = 1450 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml size = 256 True 1
Fn
Data
Write \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab size = 10240 True 249
Fn
Data
Registry (1)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender - False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\sysnative\vssadmin.exe os_pid = 0xae4, creation_flags = CREATE_NO_WINDOW, show_window = SW_HIDE True 1
Fn
Module (2)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\yfekw5dmgyvjgc.exe base_address = 0x80000 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\yfekw5dmgyvjgc.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe, size = 260 True 1
Fn
Service (57)
»
Operation Additional Information Success Count Logfile
Control service_name = WinDefend True 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (1)
»
Operation Additional Information Success Count Logfile
Sleep duration = -1 (infinite) False 1
Fn
Process #3: cmd.exe
121 0
»
Information Value
ID #3
File Name c:\windows\syswow64\cmd.exe
Command Line /c "C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:10, Reason: Self Terminated
Monitor Duration 00:00:04
OS Process Information
»
Information Value
PID 0xad0
Parent PID 0xaac (c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AD4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory r True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File rwx False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory r True False False -
locale.nls 0x00070000 0x000d6fff Memory Mapped File r False False False -
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory rw True False False -
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory rw True False False -
private_0x0000000000100000 0x00100000 0x00100fff Private Memory rw True False False -
private_0x0000000000110000 0x00110000 0x0011ffff Private Memory rw True False False -
private_0x0000000000130000 0x00130000 0x001affff Private Memory rw True False False -
private_0x00000000001d0000 0x001d0000 0x0020ffff Private Memory rw True False False -
private_0x0000000000260000 0x00260000 0x0026ffff Private Memory rw True False False -
private_0x00000000002e0000 0x002e0000 0x003dffff Private Memory rw True False False -
kernelbase.dll.mui 0x003e0000 0x0049ffff Memory Mapped File rw False False False -
private_0x00000000004a0000 0x004a0000 0x0059ffff Private Memory rw True False False -
pagefile_0x00000000005a0000 0x005a0000 0x00727fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000730000 0x00730000 0x008b0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000008c0000 0x008c0000 0x01cbffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001cc0000 0x01cc0000 0x02002fff Pagefile Backed Memory r True False False -
cmd.exe 0x49f80000 0x49fcbfff Memory Mapped File rwx True False False -
wow64cpu.dll 0x74d90000 0x74d97fff Memory Mapped File rwx False False False -
wow64win.dll 0x74da0000 0x74dfbfff Memory Mapped File rwx False False False -
wow64.dll 0x74e00000 0x74e3efff Memory Mapped File rwx False False False -
winbrand.dll 0x75270000 0x75276fff Memory Mapped File rwx False False False -
cryptbase.dll 0x753a0000 0x753abfff Memory Mapped File rwx False False False -
sspicli.dll 0x753b0000 0x7540ffff Memory Mapped File rwx False False False -
usp10.dll 0x75410000 0x754acfff Memory Mapped File rwx False False False -
user32.dll 0x756f0000 0x757effff Memory Mapped File rwx False False False -
kernel32.dll 0x75a20000 0x75b2ffff Memory Mapped File rwx False False False -
advapi32.dll 0x75b30000 0x75bcffff Memory Mapped File rwx False False False -
msctf.dll 0x75d40000 0x75e0bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x75e30000 0x75edbfff Memory Mapped File rwx False False False -
sechost.dll 0x762b0000 0x762c8fff Memory Mapped File rwx False False False -
lpk.dll 0x762d0000 0x762d9fff Memory Mapped File rwx False False False -
imm32.dll 0x76500000 0x7655ffff Memory Mapped File rwx False False False -
kernelbase.dll 0x765f0000 0x76635fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772d0000 0x773bffff Memory Mapped File rwx False False False -
gdi32.dll 0x773c0000 0x7744ffff Memory Mapped File rwx False False False -
private_0x0000000077450000 0x77450000 0x77549fff Private Memory rwx True False False -
private_0x0000000077550000 0x77550000 0x7766efff Private Memory rwx True False False -
ntdll.dll 0x77670000 0x77818fff Memory Mapped File rwx False False False -
ntdll.dll 0x77850000 0x779cffff Memory Mapped File rwx False False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory r True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory rw True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory rw True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory rw True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory r True False False -
Host Behavior
File (74)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 3
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 2
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop type = file_attributes True 2
Fn
Get Info STD_INPUT_HANDLE type = file_type True 3
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roamingroamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\C:\Users\5p5NrGJn0jS HALPmcxz\AppData type = file_attributes False 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 2
Fn
Get Info STD_INPUT_HANDLE type = file_type True 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat type = file_attributes True 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 13
Fn
Open STD_INPUT_HANDLE - True 7
Fn
Open STD_INPUT_HANDLE - True 12
Fn
Open STD_ERROR_HANDLE - True 6
Fn
Open STD_INPUT_HANDLE - True 8
Fn
Read STD_INPUT_HANDLE size = 8191, size_out = 309 True 1
Fn
Data
Read STD_INPUT_HANDLE size = 8191, size_out = 298 True 1
Fn
Data
Read STD_INPUT_HANDLE size = 8191, size_out = 294 True 1
Fn
Data
Read STD_INPUT_HANDLE size = 8191, size_out = 183 True 1
Fn
Data
Read STD_INPUT_HANDLE size = 8191, size_out = 60 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 68 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 33 True 1
Fn
Data
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat - True 1
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (12)
»
Operation Module Additional Information Success Count Logfile
Load ADVAPI32.dll base_address = 0x75b30000 True 1
Fn
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x49f80000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75a20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x75a4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x75a53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x75a34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x75a4a79d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SaferIdentifyLevel, address_out = 0x75b52102 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SaferComputeTokenFromLevel, address_out = 0x75b53352 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SaferCloseLevel, address_out = 0x75b53825 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-01-04 14:40:10 (UTC) True 1
Fn
Get Time type = Ticks, time = 136454 True 1
Fn
Environment (14)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = APPDATA, result_out = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming True 2
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Process #4: vssadmin.exe
0 0
»
Information Value
ID #4
File Name c:\windows\system32\vssadmin.exe
Command Line delete shadows /all /quiet
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:31, Reason: Self Terminated
Monitor Duration 00:00:25
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xae4
Parent PID 0xac8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\yfekw5dmgyvjgc.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AE8
0x B24
0x B28
0x B2C
0x B30
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory r True False False -
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory rw True False False -
vssadmin.exe.mui 0x000e0000 0x000ecfff Memory Mapped File rw False False False -
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory rw True False False -
private_0x0000000000100000 0x00100000 0x00100fff Private Memory rw True False False -
pagefile_0x0000000000110000 0x00110000 0x00110fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory r True False False -
private_0x0000000000140000 0x00140000 0x0014ffff Private Memory rw True False False -
private_0x00000000001d0000 0x001d0000 0x0024ffff Private Memory rw True False False -
private_0x0000000000250000 0x00250000 0x0034ffff Private Memory rw True False False -
private_0x00000000003e0000 0x003e0000 0x004dffff Private Memory rw True False False -
pagefile_0x00000000004e0000 0x004e0000 0x00667fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000670000 0x00670000 0x007f0fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000800000 0x00800000 0x01bfffff Pagefile Backed Memory r True False False -
private_0x0000000001c30000 0x01c30000 0x01caffff Private Memory rw True False False -
private_0x0000000001cd0000 0x01cd0000 0x01d4ffff Private Memory rw True False False -
private_0x0000000001e40000 0x01e40000 0x01ebffff Private Memory rw True False False -
sortdefault.nls 0x01ec0000 0x0218efff Memory Mapped File r False False False -
private_0x00000000021e0000 0x021e0000 0x0225ffff Private Memory rw True False False -
user32.dll 0x77450000 0x77549fff Memory Mapped File rwx False False False -
kernel32.dll 0x77550000 0x7766efff Memory Mapped File rwx False False False -
ntdll.dll 0x77670000 0x77818fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff6000 0x7fff6000 0x7fff6fff Private Memory rw True False False -
vssadmin.exe 0xff940000 0xff96cfff Memory Mapped File rwx False False False -
vss_ps.dll 0x7fef3e60000 0x7fef3e73fff Memory Mapped File rwx False False False -
vsstrace.dll 0x7fef79b0000 0x7fef79c6fff Memory Mapped File rwx False False False -
vssapi.dll 0x7fef79d0000 0x7fef7b7ffff Memory Mapped File rwx False False False -
atl.dll 0x7fefb070000 0x7fefb088fff Memory Mapped File rwx False False False -
rsaenh.dll 0x7fefcbb0000 0x7fefcbf6fff Memory Mapped File rwx False False False -
cryptsp.dll 0x7fefceb0000 0x7fefcec6fff Memory Mapped File rwx False False False -
cryptbase.dll 0x7fefd4b0000 0x7fefd4befff Memory Mapped File rwx False False False -
rpcrtremote.dll 0x7fefd5a0000 0x7fefd5b3fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefd920000 0x7fefd98afff Memory Mapped File rwx False False False -
msvcrt.dll 0x7fefdb10000 0x7fefdbaefff Memory Mapped File rwx False False False -
oleaut32.dll 0x7fefdbb0000 0x7fefdc86fff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdc90000 0x7fefdcf6fff Memory Mapped File rwx False False False -
usp10.dll 0x7fefdd00000 0x7fefddc8fff Memory Mapped File rwx False False False -
ole32.dll 0x7fefddf0000 0x7fefdff2fff Memory Mapped File rwx False False False -
clbcatq.dll 0x7fefe000000 0x7fefe098fff Memory Mapped File rwx False False False -
msctf.dll 0x7fefe0a0000 0x7fefe1a8fff Memory Mapped File rwx False False False -
sechost.dll 0x7fefe330000 0x7fefe34efff Memory Mapped File rwx False False False -
lpk.dll 0x7fefe350000 0x7fefe35dfff Memory Mapped File rwx False False False -
advapi32.dll 0x7feff740000 0x7feff81afff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7feff820000 0x7feff94cfff Memory Mapped File rwx False False False -
imm32.dll 0x7feff950000 0x7feff97dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7feff990000 0x7feff990fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory rw True False False -
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory rw True False False -
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory rw True False False -
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdbfff Private Memory rw True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image