51bc3278...eee4 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 95/100
Dynamic Analysis Report
Classification: Trojan, Keylogger, Spyware

51bc32788b49aca2384cd07dce9f8ac63f07f52c27cf33c938e01c64c374eee4 (SHA256)

worldtime.exe

Windows Exe (x86-32)

Created at 2018-10-30 17:02:00

...

Notifications (2/2)

Code overwrite was observed during this analysis. Note that the analysis results may be affected by this modification by the sample.

The operating system was rebooted during the analysis.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xc38 Analysis Target High (Elevated) worldtime.exe "C:\Users\CIiHmnxMn6Ps\Desktop\worldtime.exe" -
#2 0xcfc Child Process High (Elevated) cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat" "C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe" "C:\Users\CIIHMN~1\Desktop\WORLDT~1.EXE"" #1
#4 0xd20 Child Process High (Elevated) cmd.exe cmd /C ""C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe" "C:\Users\CIIHMN~1\Desktop\WORLDT~1.EXE"" #2
#5 0xd2c Child Process High (Elevated) autoclb.exe "C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe" "C:\Users\CIIHMN~1\Desktop\WORLDT~1.EXE" #4
#6 0xdd0 Child Process High (Elevated) svchost.exe C:\Windows\system32\svchost.exe #5
#7 0x508 Injection Medium explorer.exe C:\Windows\Explorer.EXE #6
#8 0x590 Autostart Medium autoclb.exe "C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe" -
#9 0x910 Child Process Medium svchost.exe C:\Windows\system32\svchost.exe #8
#10 0x810 Injection Medium explorer.exe C:\Windows\Explorer.EXE #9

Behavior Information - Grouped by Category

Process #1: worldtime.exe
1238 0
»
Information Value
ID #1
File Name c:\users\ciihmnxmn6ps\desktop\worldtime.exe
Command Line "C:\Users\CIiHmnxMn6Ps\Desktop\worldtime.exe"
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:26, Reason: Analysis Target
Unmonitor End Time: 00:00:48, Reason: Self Terminated
Monitor Duration 00:00:22
OS Process Information
»
Information Value
PID 0xc38
Parent PID 0x508 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x C3C
0x C40
0x C54
0x CC0
0x CCC
0x CE4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00023fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
pagefile_0x0000000000040000 0x00040000 0x00053fff Pagefile Backed Memory r True False False -
private_0x0000000000060000 0x00060000 0x0009ffff Private Memory rw True False False -
private_0x0000000000060000 0x00060000 0x00063fff Private Memory rw True False False -
pagefile_0x0000000000070000 0x00070000 0x00070fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000080000 0x00080000 0x00080fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000090000 0x00090000 0x00090fff Pagefile Backed Memory r True False False -
private_0x00000000000a0000 0x000a0000 0x0019ffff Private Memory rw True False False -
cversions.2.db 0x000a0000 0x000a3fff Memory Mapped File r True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db 0x000b0000 0x000f2fff Memory Mapped File r True False False -
cversions.2.db 0x00100000 0x00103fff Memory Mapped File r True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db 0x00110000 0x0019afff Memory Mapped File r True False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory r True False False -
private_0x00000000001c0000 0x001c0000 0x001c1fff Private Memory rw True False False -
locale.nls 0x001d0000 0x0028dfff Memory Mapped File r False False False -
private_0x0000000000290000 0x00290000 0x002cffff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x002d0fff Private Memory rw True False False -
pagefile_0x00000000002e0000 0x002e0000 0x002e1fff Pagefile Backed Memory r True False False -
private_0x00000000002f0000 0x002f0000 0x002fffff Private Memory rw True False False -
private_0x0000000000300000 0x00300000 0x003fffff Private Memory rw True False False -
worldtime.exe 0x00400000 0x0054efff Memory Mapped File rwx True True False
...
pagefile_0x0000000000550000 0x00550000 0x006d7fff Pagefile Backed Memory r True False False -
private_0x00000000006e0000 0x006e0000 0x006e1fff Private Memory rw True False False -
pagefile_0x00000000006f0000 0x006f0000 0x006f1fff Pagefile Backed Memory r True False False -
private_0x0000000000700000 0x00700000 0x00703fff Private Memory rw True False False -
private_0x0000000000710000 0x00710000 0x00710fff Private Memory rwx True False False -
propsys.dll.mui 0x00710000 0x00720fff Memory Mapped File r False False False -
cversions.1.db 0x00730000 0x00733fff Memory Mapped File r True False False -
private_0x0000000000740000 0x00740000 0x0083ffff Private Memory rw True False False -
private_0x0000000000840000 0x00840000 0x0087ffff Private Memory rw True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db 0x00880000 0x00892fff Memory Mapped File r True False False -
pagefile_0x00000000008a0000 0x008a0000 0x008a0fff Pagefile Backed Memory rw True False False -
private_0x00000000008c0000 0x008c0000 0x008cffff Private Memory rw True False False -
pagefile_0x00000000008d0000 0x008d0000 0x00a50fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000a60000 0x00a60000 0x01e5ffff Pagefile Backed Memory r True False False -
private_0x0000000001e60000 0x01e60000 0x01e9ffff Private Memory rw True False False -
private_0x0000000001ea0000 0x01ea0000 0x01edffff Private Memory rw True False False -
private_0x0000000001ee0000 0x01ee0000 0x01f1ffff Private Memory rw True False False -
private_0x0000000001f30000 0x01f30000 0x01f3ffff Private Memory rw True False False -
private_0x0000000001f40000 0x01f40000 0x0204ffff Private Memory rw True False False -
private_0x0000000001f40000 0x01f40000 0x0203ffff Private Memory rw True False False -
private_0x0000000002040000 0x02040000 0x0204ffff Private Memory rw True False False -
pagefile_0x0000000002050000 0x02050000 0x0244ffff Pagefile Backed Memory rw True False False -
private_0x0000000002450000 0x02450000 0x0255ffff Private Memory rw True False False -
private_0x0000000002450000 0x02450000 0x0254ffff Private Memory rw True False False -
private_0x0000000002550000 0x02550000 0x0255ffff Private Memory rw True False False -
private_0x0000000002560000 0x02560000 0x028effff Private Memory rwx True False False -
private_0x00000000028f0000 0x028f0000 0x029effff Private Memory rw True False False -
private_0x00000000029f0000 0x029f0000 0x02f9ffff Private Memory rw True False False -
private_0x00000000029f0000 0x029f0000 0x02b3ffff Private Memory rw True False False -
private_0x0000000002b90000 0x02b90000 0x02f9ffff Private Memory rw True False False -
sortdefault.nls 0x02fa0000 0x032d6fff Memory Mapped File r False False False -
private_0x00000000032e0000 0x032e0000 0x033dffff Private Memory rw True False False -
private_0x00000000033e0000 0x033e0000 0x034dffff Private Memory rw True False False -
private_0x00000000034e0000 0x034e0000 0x035dffff Private Memory rw True False False -
wow64cpu.dll 0x64ae0000 0x64ae7fff Memory Mapped File rwx False False False -
wow64win.dll 0x64af0000 0x64b62fff Memory Mapped File rwx False False False -
wow64.dll 0x64b70000 0x64bbefff Memory Mapped File rwx False False False -
iertutil.dll 0x74280000 0x74540fff Memory Mapped File rwx False False False -
urlmon.dll 0x74550000 0x746affff Memory Mapped File rwx False False False -
rsaenh.dll 0x746b0000 0x746defff Memory Mapped File rwx False False False -
bcrypt.dll 0x746e0000 0x746fafff Memory Mapped File rwx False False False -
cryptsp.dll 0x74700000 0x74712fff Memory Mapped File rwx False False False -
propsys.dll 0x74720000 0x74861fff Memory Mapped File rwx False False False -
devobj.dll 0x74870000 0x74890fff Memory Mapped File rwx False False False -
winsta.dll 0x748a0000 0x748e3fff Memory Mapped File rwx False False False -
comctl32.dll 0x748f0000 0x74af8fff Memory Mapped File rwx False False False -
tapi32.dll 0x74b00000 0x74b33fff Memory Mapped File rwx False False False -
wtsapi32.dll 0x74b40000 0x74b4efff Memory Mapped File rwx False False False -
version.dll 0x74b50000 0x74b57fff Memory Mapped File rwx False False False -
comctl32.dll 0x74b60000 0x74bf1fff Memory Mapped File rwx False False False -
uxtheme.dll 0x74c20000 0x74c94fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74d40000 0x74d98fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74da0000 0x74da9fff Memory Mapped File rwx False False False -
sspicli.dll 0x74db0000 0x74dcdfff Memory Mapped File rwx False False False -
kernelbase.dll 0x74e70000 0x74fe5fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x75220000 0x75255fff Memory Mapped File rwx False False False -
kernel32.dll 0x75260000 0x7534ffff Memory Mapped File rwx False False False -
powrprof.dll 0x753b0000 0x753f3fff Memory Mapped File rwx False False False -
imm32.dll 0x75400000 0x7542afff Memory Mapped File rwx False False False -
shell32.dll 0x75430000 0x767eefff Memory Mapped File rwx False False False -
profapi.dll 0x76810000 0x7681efff Memory Mapped File rwx False False False -
clbcatq.dll 0x76820000 0x768a1fff Memory Mapped File rwx False False False -
ole32.dll 0x768b0000 0x76999fff Memory Mapped File rwx False False False -
advapi32.dll 0x76a10000 0x76a8afff Memory Mapped File rwx False False False -
setupapi.dll 0x76a90000 0x76c34fff Memory Mapped File rwx False False False -
sechost.dll 0x76c40000 0x76c82fff Memory Mapped File rwx False False False -
oleaut32.dll 0x76c90000 0x76d21fff Memory Mapped File rwx False False False -
msasn1.dll 0x76d30000 0x76d3dfff Memory Mapped File rwx False False False -
wintrust.dll 0x76d40000 0x76d81fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x76d90000 0x76e3bfff Memory Mapped File rwx False False False -
combase.dll 0x76e40000 0x76ff9fff Memory Mapped File rwx False False False -
gdi32.dll 0x77000000 0x7714cfff Memory Mapped File rwx False False False -
user32.dll 0x77150000 0x7728ffff Memory Mapped File rwx False False False -
shlwapi.dll 0x77290000 0x772d3fff Memory Mapped File rwx False False False -
shcore.dll 0x77340000 0x773ccfff Memory Mapped File rwx False False False -
windows.storage.dll 0x773f0000 0x778ccfff Memory Mapped File rwx False False False -
msctf.dll 0x778d0000 0x779effff Memory Mapped File rwx False False False -
msvcrt.dll 0x779f0000 0x77aadfff Memory Mapped File rwx False False False -
crypt32.dll 0x77ab0000 0x77c24fff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x77c30000 0x77c3bfff Memory Mapped File rwx False False False -
ntdll.dll 0x77ca0000 0x77e18fff Memory Mapped File rwx False False False -
private_0x000000007feaa000 0x7feaa000 0x7feacfff Private Memory rw True False False -
private_0x000000007fead000 0x7fead000 0x7feaffff Private Memory rw True False False -
pagefile_0x000000007feb0000 0x7feb0000 0x7ffaffff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd5000 0x7ffd5000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffd8000 0x7ffd8000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7ff8ee37ffff Private Memory r True False False -
ntdll.dll 0x7ff8ee380000 0x7ff8ee541fff Memory Mapped File rwx False False False -
private_0x00007ff8ee542000 0x7ff8ee542000 0x7ffffffeffff Private Memory r True False False -
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000002560000:+0x39f4 130. entry of worldtime.exe 4 bytes kernel32.dll:GetSystemInfo+0x0 now points to kernel32.dll:+0x10000
...
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.tmp 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3:: 		False
...
C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat 0.11 KB MD5: 2af2261a8591e22a5e3c41fc603a4340
SHA1: c46a5f2b4aed20df44c8d4cb394abd101b8a274e
SHA256: ddbbdd9a5e9ac3df7eeeffed148aa2ef075e4b186383e6121259292235ad6cc7
SSDeep: 3:5WxvGLK6OWRNfeURwv+gU64vHXMJATkUE1zWxvfBos+n:IAlRhmvGvvHXMJ2dm6xBL+n 		False
...
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe 1.29 MB MD5: 9d00145017261466596a4e6e66480fb6
SHA1: 5288c791ee5766998bf3522abba9d33b3ec21a74
SHA256: ef6111afc2b62eef53a1e3a9a7fe2f5762e0e58d8e1274ede2c987d1303701ce
SSDeep: 24576:Zy8RCFEr8W1tVIFy8aCbC8zl0LYJJyQ6+vYnbaFtMfvmdj:ZywCF6Eu8zmMJyQzv9TMfut 		False
...
Host Behavior
File (24)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\CIIHMN~1\AppData\Local\Temp\98F9CE91 desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Windows\system32\c_1252.nls desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 3
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\worldtime.exe desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create Directory C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw - True 1
Fn
Create Directory C:\Users\CIIHMN~1\AppData\Local\Temp\19FE - True 1
Fn
Create Temp File C:\Users\CIIHMN~1\AppData\Local\Temp\19FE.tmp path = C:\Users\CIIHMN~1\AppData\Local\Temp\ True 1
Fn
Create Temp File C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.tmp path = C:\Users\CIIHMN~1\AppData\Local\Temp\19FE True 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\worldtime.exe type = size True 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Read C:\Users\CIiHmnxMn6Ps\Desktop\worldtime.exe size = 1357824, size_out = 1357824 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe size = 4096 True 2
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe size = 1353728 True 1
Fn
Write C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat size = 110 True 1
Fn
Data
Registry (129)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_CURRENT_USER - True 71
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_USERS - True 1
Fn
Open Key HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders - True 1
Fn
Open Key HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Read Value HKEY_CURRENT_USER value_name = Value, data = 0 False 38
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = InstallDate, data = 65 True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = cabilipc, data = 160, type = REG_NONE False 1
Fn
Read Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders value_name = AppData, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders value_name = AppData, data = C:\Users\CIiHmnxMn6Ps\AppData\Roaming, type = REG_SZ True 1
Fn
Read Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Client, data = 0, type = REG_NONE False 1
Fn
Write Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Run value_name = cabilipc, data = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe, size = 118, type = REG_SZ True 1
Fn
Write Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Install, size = 118, type = REG_BINARY True 1
Fn
Data
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - False 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat show_window = SW_HIDE True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Module (182)
»
Operation Module Additional Information Success Count Logfile
Load ntdll.dll base_address = 0x77ca0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x77290000 True 1
Fn
Load SETUPAPI.dll base_address = 0x76a90000 True 1
Fn
Load KERNEL32.dll base_address = 0x75260000 True 1
Fn
Load USER32.dll base_address = 0x77150000 True 1
Fn
Load ADVAPI32.dll base_address = 0x76a10000 True 1
Fn
Load SHELL32.dll base_address = 0x75430000 True 1
Fn
Load ole32.dll base_address = 0x768b0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75260000 True 13
Fn
Get Handle c:\windows\syswow64\ntdll.dll base_address = 0x77ca0000 True 3
Fn
Get Handle c:\windows\syswow64\advapi32.dll base_address = 0x76a10000 True 2
Fn
Get Handle c:\users\ciihmnxmn6ps\desktop\worldtime.exe base_address = 0x400000 True 4
Fn
Get Handle c:\windows\syswow64\user32.dll base_address = 0x77150000 True 1
Fn
Get Filename - process_name = c:\users\ciihmnxmn6ps\desktop\worldtime.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\worldtime.exe, size = 260 True 3
Fn
Get Filename c:\users\ciihmnxmn6ps\desktop\worldtime.exe process_name = c:\users\ciihmnxmn6ps\desktop\worldtime.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\worldtime.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x7527a330 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x75277580 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x75279910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x7527f400 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77cff190 True 8
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77cfa200 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x75279680 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = memset, address_out = 0x77d0ee50 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = strstr, address_out = 0x77d10010 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = mbstowcs, address_out = 0x77d0e610 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlNtStatusToDosError, address_out = 0x77cf3010 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = memcpy, address_out = 0x77d0e7b0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlGetVersion, address_out = 0x77cffcd0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlUnwind, address_out = 0x77cfaca0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwQueryInformationProcess, address_out = 0x77d08d50 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77d08f40 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwOpenProcessToken, address_out = 0x77d09d20 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwQueryInformationToken, address_out = 0x77d08df0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwClose, address_out = 0x77d08cb0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwOpenProcess, address_out = 0x77d08e40 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtUnmapViewOfSection, address_out = 0x77d08e80 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtMapViewOfSection, address_out = 0x77d08e60 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtCreateSection, address_out = 0x77d09080 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlFreeUnicodeString, address_out = 0x77cdb940 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlUpcaseUnicodeString, address_out = 0x77cee040 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = _aulldiv, address_out = 0x77d0c680 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQueryVirtualMemory, address_out = 0x77d08e10 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrStrIA, address_out = 0x772acd10 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrChrW, address_out = 0x772a6a00 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x772a80d0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathCombineW, address_out = 0x772acd50 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionA, address_out = 0x772b1db0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrChrA, address_out = 0x772b26c0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrTrimW, address_out = 0x772a83a0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x772a7c40 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrRChrA, address_out = 0x772b2900 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiGetDeviceRegistryPropertyA, address_out = 0x76ae19a0 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiGetClassDevsA, address_out = 0x76ab8d10 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiEnumDeviceInfo, address_out = 0x76aa5620 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiDestroyDeviceInfoList, address_out = 0x76aa5340 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x752725e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x7527f4b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x752874f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x75279640 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x7527a4b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitThread, address_out = 0x77d02570 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x75285f20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x75279700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapDestroy, address_out = 0x7527d940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapCreate, address_out = 0x75279950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEvent, address_out = 0x752860c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x7529d410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x75286510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x75272d80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x7527e320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SwitchToThread, address_out = 0x75279f30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x752864f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventA, address_out = 0x75285f70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x752862a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTempPathA, address_out = 0x75286410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x75272db0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileA, address_out = 0x75286270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77cdda90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x75277540 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x75277940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetWaitableTimer, address_out = 0x752860d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x752857f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x7529d320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x752861d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x75286170 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareFileTime, address_out = 0x75286130 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResetEvent, address_out = 0x752860b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x75286590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileTime, address_out = 0x75286380 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x752a0960 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x75286150 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x752861b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x75286180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateWaitableTimerA, address_out = 0x7527db30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResumeThread, address_out = 0x7527a280 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SuspendThread, address_out = 0x7527ed00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpA, address_out = 0x7527c1f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynA, address_out = 0x7527f7b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x752787c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsA, address_out = 0x752a0da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x752777b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x75283a30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x7527efc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x75286110 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x752864a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x7527c8c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x75286140 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtectEx, address_out = 0x752a2a00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileA, address_out = 0x75286210 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x7527a040 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x75279560 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSize, address_out = 0x75286360 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x752792b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateRemoteThread, address_out = 0x752a0a00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x75278b70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x75277610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x75278c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x75272af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x75271d90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x7527a300 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLongPathNameW, address_out = 0x752747c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x75286530 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTempFileNameA, address_out = 0x752863f0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfA, address_out = 0x7717ea00 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharUpperA, address_out = 0x771831c0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = FindWindowA, address_out = 0x77180980 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfW, address_out = 0x7717ddf0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x771ccf50 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x76a2ed60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumKeyExA, address_out = 0x76a32520 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyW, address_out = 0x76a2f590 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegDeleteValueW, address_out = 0x76a30ca0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ConvertStringSecurityDescriptorToSecurityDescriptorA, address_out = 0x76a5bda0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x76a2f0a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetSidSubAuthorityCount, address_out = 0x76a30f50 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetSidSubAuthority, address_out = 0x76a30ea0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x76a2ee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyA, address_out = 0x76a331a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExA, address_out = 0x76a30750 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyA, address_out = 0x76a33150 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x76a2ed40 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x76a2efa0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x76a2ee40 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x76a2f000 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteW, address_out = 0x755c4370 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x755c4cb0 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = 92, address_out = 0x756a7560 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x76eadca0 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeEx, address_out = 0x76eacd50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsWow64Process, address_out = 0x752796e0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowThreadProcessId, address_out = 0x7716ba70 True 1
Fn
Create Mapping - filename = System Paging File, protection = PAGE_READWRITE, SEC_RESERVE, maximum_size = 4194304 True 1
Fn
Map - process_name = c:\users\ciihmnxmn6ps\desktop\worldtime.exe, desired_access = FILE_MAP_ALL_ACCESS True 1
Fn
Window (2)
»
Operation Window Name Additional Information Success Count Logfile
Find - class_name = ProgMan True 1
Fn
Set Attribute - index = 18446744073709551596, new_long = 128 False 1
Fn
System (889)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Get Cursor x_out = 819, y_out = 480 True 800
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 10
Fn
Get Time type = System Time, time = 2018-10-30 17:03:31 (UTC) True 70
Fn
Get Time type = System Time, time = 2018-10-30 17:03:32 (UTC) True 1
Fn
Get Time type = Ticks, time = 118375 True 1
Fn
Get Time type = Ticks, time = 124031 True 4
Fn
Get Info type = Hardware Information True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #2: cmd.exe
254 0
»
Information Value
ID #2
File Name c:\windows\syswow64\cmd.exe
Command Line C:\Windows\system32\cmd.exe /c ""C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat" "C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe" "C:\Users\CIIHMN~1\Desktop\WORLDT~1.EXE""
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:45, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:17
OS Process Information
»
Information Value
PID 0xcfc
Parent PID 0xc38 (c:\users\ciihmnxmn6ps\desktop\worldtime.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D00
0x D18
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000e60000 0x00e60000 0x00e7ffff Private Memory rw True False False -
pagefile_0x0000000000e60000 0x00e60000 0x00e6ffff Pagefile Backed Memory rw True False False -
private_0x0000000000e70000 0x00e70000 0x00e73fff Private Memory rw True False False -
private_0x0000000000e80000 0x00e80000 0x00e81fff Private Memory rw True False False -
private_0x0000000000e80000 0x00e80000 0x00e8ffff Private Memory rw True False False -
pagefile_0x0000000000e90000 0x00e90000 0x00ea3fff Pagefile Backed Memory r True False False -
private_0x0000000000eb0000 0x00eb0000 0x00eeffff Private Memory rw True False False -
private_0x0000000000ef0000 0x00ef0000 0x00feffff Private Memory rw True False False -
pagefile_0x0000000000ff0000 0x00ff0000 0x00ff3fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001000000 0x01000000 0x01000fff Pagefile Backed Memory r True False False -
private_0x0000000001010000 0x01010000 0x01011fff Private Memory rw True False False -
locale.nls 0x01020000 0x010ddfff Memory Mapped File r False False False -
private_0x00000000010e0000 0x010e0000 0x0111ffff Private Memory rw True False False -
private_0x0000000001120000 0x01120000 0x01123fff Private Memory rw True False False -
private_0x0000000001130000 0x01130000 0x0113ffff Private Memory rw True False False -
cmd.exe.mui 0x01140000 0x01160fff Memory Mapped File r False False False -
private_0x0000000001170000 0x01170000 0x0117ffff Private Memory rw True False False -
private_0x0000000001180000 0x01180000 0x0127ffff Private Memory rw True False False -
cmd.exe 0x01290000 0x012dffff Memory Mapped File rwx True False False -
pagefile_0x00000000012e0000 0x012e0000 0x052dffff Pagefile Backed Memory - True False False -
private_0x00000000053b0000 0x053b0000 0x054affff Private Memory rw True False False -
sortdefault.nls 0x054b0000 0x057e6fff Memory Mapped File r False False False -
wow64cpu.dll 0x64ae0000 0x64ae7fff Memory Mapped File rwx False False False -
wow64win.dll 0x64af0000 0x64b62fff Memory Mapped File rwx False False False -
wow64.dll 0x64b70000 0x64bbefff Memory Mapped File rwx False False False -
cmdext.dll 0x74bf0000 0x74bf7fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74d40000 0x74d98fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74da0000 0x74da9fff Memory Mapped File rwx False False False -
sspicli.dll 0x74db0000 0x74dcdfff Memory Mapped File rwx False False False -
kernelbase.dll 0x74e70000 0x74fe5fff Memory Mapped File rwx False False False -
kernel32.dll 0x75260000 0x7534ffff Memory Mapped File rwx False False False -
advapi32.dll 0x76a10000 0x76a8afff Memory Mapped File rwx False False False -
sechost.dll 0x76c40000 0x76c82fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x76d90000 0x76e3bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x779f0000 0x77aadfff Memory Mapped File rwx False False False -
ntdll.dll 0x77ca0000 0x77e18fff Memory Mapped File rwx False False False -
pagefile_0x000000007fa40000 0x7fa40000 0x7fb3ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007fb40000 0x7fb40000 0x7fb62fff Pagefile Backed Memory r True False False -
private_0x000000007fb66000 0x7fb66000 0x7fb68fff Private Memory rw True False False -
private_0x000000007fb69000 0x7fb69000 0x7fb6bfff Private Memory rw True False False -
private_0x000000007fb6c000 0x7fb6c000 0x7fb6cfff Private Memory rw True False False -
private_0x000000007fb6e000 0x7fb6e000 0x7fb6efff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7df8ee37ffff Private Memory r True False False -
pagefile_0x00007df8ee380000 0x7df8ee380000 0x7ff8ee37ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ff8ee380000 0x7ff8ee541fff Memory Mapped File rwx False False False -
private_0x00007ff8ee542000 0x7ff8ee542000 0x7ffffffeffff Private Memory r True False False -
Host Behavior
File (202)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 3
Fn
Create C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 3
Fn
Create C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop type = file_attributes True 2
Fn
Get Info "C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat" type = file_attributes False 1
Fn
Get Info - type = file_type True 3
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 25
Fn
Get Info - type = file_type True 3
Fn
Get Info C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat type = file_attributes True 2
Fn
Get Info C:\Users\CIIHMN~1\AppData\Local\Temp\19FE type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 88
Fn
Open STD_INPUT_HANDLE - True 7
Fn
Open - - True 12
Fn
Open - - True 13
Fn
Open \??\C:\Users\CIIHMN~1\AppData\Local\Temp\19FE\E47F.bat desired_access = DELETE, open_options = FILE_NON_DIRECTORY_FILE, FILE_DELETE_ON_CLOSE, FILE_OPEN_FOR_BACKUP_INTENT, share_mode = FILE_SHARE_DELETE True 1
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Read - size = 8191, size_out = 110 True 1
Fn
Data
Read - size = 8191, size_out = 99 True 1
Fn
Data
Read - size = 8191, size_out = 66 True 1
Fn
Data
Read - size = 8191, size_out = 50 True 1
Fn
Data
Read - size = 8191, size_out = 19 True 1
Fn
Data
Read - size = 8191, size_out = 6 True 1
Fn
Data
Read - size = 8191, size_out = 0 True 1
Fn
Write STD_OUTPUT_HANDLE size = 2 True 8
Fn
Data
Write STD_OUTPUT_HANDLE size = 30 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 3 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 4 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 63 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 12 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 104 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 13 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 10 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 54 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 33 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 200, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0xd20, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x1290000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75260000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x752a2780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x7527fa80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x7527a790 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x74f835c0 True 1
Fn
Environment (24)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 3
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 4
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 2
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\CIiHmnxMn6Ps\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #4: cmd.exe
54 0
»
Information Value
ID #4
File Name c:\windows\syswow64\cmd.exe
Command Line cmd /C ""C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe" "C:\Users\CIIHMN~1\Desktop\WORLDT~1.EXE""
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:49, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:11
OS Process Information
»
Information Value
PID 0xd20
Parent PID 0xcfc (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D24
0x D28
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000240000 0x00240000 0x0025ffff Private Memory rw True False False -
pagefile_0x0000000000240000 0x00240000 0x0024ffff Pagefile Backed Memory rw True False False -
private_0x0000000000250000 0x00250000 0x00253fff Private Memory rw True False False -
private_0x0000000000260000 0x00260000 0x00261fff Private Memory rw True False False -
private_0x0000000000260000 0x00260000 0x00263fff Private Memory rw True False False -
pagefile_0x0000000000270000 0x00270000 0x00283fff Pagefile Backed Memory r True False False -
private_0x0000000000290000 0x00290000 0x002cffff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x003cffff Private Memory rw True False False -
pagefile_0x00000000003d0000 0x003d0000 0x003d3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000003e0000 0x003e0000 0x003e0fff Pagefile Backed Memory r True False False -
private_0x00000000003f0000 0x003f0000 0x003f1fff Private Memory rw True False False -
locale.nls 0x00400000 0x004bdfff Memory Mapped File r False False False -
private_0x00000000004c0000 0x004c0000 0x004fffff Private Memory rw True False False -
private_0x0000000000530000 0x00530000 0x0053ffff Private Memory rw True False False -
private_0x0000000000540000 0x00540000 0x0063ffff Private Memory rw True False False -
private_0x0000000000670000 0x00670000 0x0076ffff Private Memory rw True False False -
private_0x0000000000930000 0x00930000 0x0093ffff Private Memory rw True False False -
sortdefault.nls 0x00940000 0x00c76fff Memory Mapped File r False False False -
cmd.exe 0x01290000 0x012dffff Memory Mapped File rwx True False False -
pagefile_0x00000000012e0000 0x012e0000 0x052dffff Pagefile Backed Memory - True False False -
wow64cpu.dll 0x64ae0000 0x64ae7fff Memory Mapped File rwx False False False -
wow64win.dll 0x64af0000 0x64b62fff Memory Mapped File rwx False False False -
wow64.dll 0x64b70000 0x64bbefff Memory Mapped File rwx False False False -
apphelp.dll 0x74ca0000 0x74d30fff Memory Mapped File rwx False False False -
kernelbase.dll 0x74e70000 0x74fe5fff Memory Mapped File rwx False False False -
kernel32.dll 0x75260000 0x7534ffff Memory Mapped File rwx False False False -
msvcrt.dll 0x779f0000 0x77aadfff Memory Mapped File rwx False False False -
ntdll.dll 0x77ca0000 0x77e18fff Memory Mapped File rwx False False False -
sysmain.sdb 0x7f670000 0x7f9fffff Memory Mapped File r False False False -
pagefile_0x000000007fa00000 0x7fa00000 0x7fafffff Pagefile Backed Memory r True False False -
pagefile_0x000000007fb00000 0x7fb00000 0x7fb22fff Pagefile Backed Memory r True False False -
private_0x000000007fb25000 0x7fb25000 0x7fb27fff Private Memory rw True False False -
private_0x000000007fb28000 0x7fb28000 0x7fb28fff Private Memory rw True False False -
private_0x000000007fb2b000 0x7fb2b000 0x7fb2bfff Private Memory rw True False False -
private_0x000000007fb2d000 0x7fb2d000 0x7fb2ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7df8ee37ffff Private Memory r True False False -
pagefile_0x00007df8ee380000 0x7df8ee380000 0x7ff8ee37ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ff8ee380000 0x7ff8ee541fff Memory Mapped File rwx False False False -
private_0x00007ff8ee542000 0x7ff8ee542000 0x7ffffffeffff Private Memory r True False False -
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\CIiHmnxMn6Ps\Desktop type = file_attributes True 2
Fn
Get Info "C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe" type = file_attributes False 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe os_pid = 0xd2c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x1290000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75260000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x752a2780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x7527fa80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x7527a790 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x74f835c0 True 1
Fn
Environment (16)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 6
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = =C:, value = C:\Users\CIiHmnxMn6Ps\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #5: autoclb.exe
1082 0
»
Information Value
ID #5
File Name c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe
Command Line "C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe" "C:\Users\CIIHMN~1\Desktop\WORLDT~1.EXE"
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:50, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:10
OS Process Information
»
Information Value
PID 0xd2c
Parent PID 0xd20 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D30
0x D34
0x D80
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00023fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
pagefile_0x0000000000040000 0x00040000 0x00053fff Pagefile Backed Memory r True False False -
private_0x0000000000060000 0x00060000 0x0009ffff Private Memory rw True False False -
private_0x0000000000060000 0x00060000 0x00063fff Private Memory rw True False False -
private_0x0000000000070000 0x00070000 0x0016ffff Private Memory rw True False False -
private_0x00000000000a0000 0x000a0000 0x0019ffff Private Memory rw True False False -
private_0x0000000000170000 0x00170000 0x00170fff Private Memory rw True False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory r True False False -
private_0x00000000001c0000 0x001c0000 0x001c1fff Private Memory rw True False False -
locale.nls 0x001d0000 0x0028dfff Memory Mapped File r False False False -
private_0x0000000000290000 0x00290000 0x002cffff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x002d0fff Private Memory rw True False False -
private_0x00000000002e0000 0x002e0000 0x002effff Private Memory rw True False False -
pagefile_0x00000000002f0000 0x002f0000 0x002f1fff Pagefile Backed Memory r True False False -
private_0x0000000000300000 0x00300000 0x00301fff Private Memory rw True False False -
pagefile_0x0000000000310000 0x00310000 0x00311fff Pagefile Backed Memory r True False False -
private_0x0000000000320000 0x00320000 0x0034ffff Private Memory rw True False False -
private_0x0000000000320000 0x00320000 0x00323fff Private Memory rw True False False -
private_0x0000000000330000 0x00330000 0x00330fff Private Memory rwx True False False -
private_0x0000000000340000 0x00340000 0x0034ffff Private Memory rw True False False -
private_0x0000000000350000 0x00350000 0x0038ffff Private Memory rw True False False -
private_0x00000000003a0000 0x003a0000 0x003affff Private Memory rw True False False -
autoclb.exe 0x00400000 0x0054efff Memory Mapped File rwx True False False -
private_0x0000000000550000 0x00550000 0x0064ffff Private Memory rw True False False -
private_0x0000000000730000 0x00730000 0x0082ffff Private Memory rw True False False -
pagefile_0x0000000000830000 0x00830000 0x009b7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000009c0000 0x009c0000 0x00b40fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000b50000 0x00b50000 0x01f4ffff Pagefile Backed Memory r True False False -
private_0x0000000001f50000 0x01f50000 0x0204ffff Private Memory rw True False False -
private_0x0000000002120000 0x02120000 0x0212ffff Private Memory rw True False False -
pagefile_0x0000000002130000 0x02130000 0x0252ffff Pagefile Backed Memory rw True False False -
private_0x0000000002530000 0x02530000 0x028bffff Private Memory rwx True False False -
private_0x00000000028c0000 0x028c0000 0x029bffff Private Memory rw True False False -
private_0x00000000029c0000 0x029c0000 0x02abffff Private Memory rw True False False -
private_0x0000000002ac0000 0x02ac0000 0x02bbffff Private Memory rw True False False -
private_0x0000000002bc0000 0x02bc0000 0x0303ffff Private Memory rw True False False -
sortdefault.nls 0x03040000 0x03376fff Memory Mapped File r False False False -
private_0x0000000003380000 0x03380000 0x03541fff Private Memory rw True False False -
pagefile_0x0000000003380000 0x03380000 0x034b2fff Pagefile Backed Memory rwx True False False -
private_0x00000000034c0000 0x034c0000 0x03681fff Private Memory rw True False False -
wow64cpu.dll 0x64ae0000 0x64ae7fff Memory Mapped File rwx False False False -
wow64win.dll 0x64af0000 0x64b62fff Memory Mapped File rwx False False False -
wow64.dll 0x64b70000 0x64bbefff Memory Mapped File rwx False False False -
devobj.dll 0x74860000 0x74880fff Memory Mapped File rwx False False False -
winsta.dll 0x74890000 0x748d3fff Memory Mapped File rwx False False False -
comctl32.dll 0x748e0000 0x74ae8fff Memory Mapped File rwx False False False -
tapi32.dll 0x74af0000 0x74b23fff Memory Mapped File rwx False False False -
wtsapi32.dll 0x74b30000 0x74b3efff Memory Mapped File rwx False False False -
version.dll 0x74b40000 0x74b47fff Memory Mapped File rwx False False False -
comctl32.dll 0x74b50000 0x74be1fff Memory Mapped File rwx False False False -
uxtheme.dll 0x74c20000 0x74c94fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74d40000 0x74d98fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74da0000 0x74da9fff Memory Mapped File rwx False False False -
sspicli.dll 0x74db0000 0x74dcdfff Memory Mapped File rwx False False False -
kernelbase.dll 0x74e70000 0x74fe5fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x75220000 0x75255fff Memory Mapped File rwx False False False -
kernel32.dll 0x75260000 0x7534ffff Memory Mapped File rwx False False False -
powrprof.dll 0x753b0000 0x753f3fff Memory Mapped File rwx False False False -
imm32.dll 0x75400000 0x7542afff Memory Mapped File rwx False False False -
shell32.dll 0x75430000 0x767eefff Memory Mapped File rwx False False False -
profapi.dll 0x76810000 0x7681efff Memory Mapped File rwx False False False -
ole32.dll 0x768b0000 0x76999fff Memory Mapped File rwx False False False -
advapi32.dll 0x76a10000 0x76a8afff Memory Mapped File rwx False False False -
setupapi.dll 0x76a90000 0x76c34fff Memory Mapped File rwx False False False -
sechost.dll 0x76c40000 0x76c82fff Memory Mapped File rwx False False False -
oleaut32.dll 0x76c90000 0x76d21fff Memory Mapped File rwx False False False -
msasn1.dll 0x76d30000 0x76d3dfff Memory Mapped File rwx False False False -
wintrust.dll 0x76d40000 0x76d81fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x76d90000 0x76e3bfff Memory Mapped File rwx False False False -
combase.dll 0x76e40000 0x76ff9fff Memory Mapped File rwx False False False -
gdi32.dll 0x77000000 0x7714cfff Memory Mapped File rwx False False False -
user32.dll 0x77150000 0x7728ffff Memory Mapped File rwx False False False -
shlwapi.dll 0x77290000 0x772d3fff Memory Mapped File rwx False False False -
shcore.dll 0x77340000 0x773ccfff Memory Mapped File rwx False False False -
windows.storage.dll 0x773f0000 0x778ccfff Memory Mapped File rwx False False False -
msctf.dll 0x778d0000 0x779effff Memory Mapped File rwx False False False -
msvcrt.dll 0x779f0000 0x77aadfff Memory Mapped File rwx False False False -
crypt32.dll 0x77ab0000 0x77c24fff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x77c30000 0x77c3bfff Memory Mapped File rwx False False False -
ntdll.dll 0x77ca0000 0x77e18fff Memory Mapped File rwx False False False -
pagefile_0x000000007feb0000 0x7feb0000 0x7ffaffff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd5000 0x7ffd5000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffd8000 0x7ffd8000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7ff8ee37ffff Private Memory r True False False -
ntdll.dll 0x7ff8ee380000 0x7ff8ee541fff Memory Mapped File rwx False False False -
private_0x00007ff8ee542000 0x7ff8ee542000 0x7ffffffeffff Private Memory r True False False -
Hook Information
»
Type Installer Target Size Information Actions
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1000 9 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x100d 5 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1013 6 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x101a 5 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1020 3 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1024 6 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x102b 5 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1031 22 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x104a 5 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1050 5 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1057 11 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1063 24 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x107d 1 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1080 30 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10a1 5 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10a7 18 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10ba 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10bf 2 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10c5 8 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10ce 17 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10e3 11 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10f2 7 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10fa 1 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x10fd 3 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1101 1 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1104 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1109 9 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1113 1 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1115 3 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x111a 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x111f 6 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1126 22 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x113d 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1143 19 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1157 18 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x116d 13 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x117b 7 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1185 19 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1199 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x119f 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x11a4 6 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x11ab 17 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x11bd 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x11c3 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x11c8 6 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x11cf 13 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x11dd 29 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x11fb 8 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1204 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x120a 6 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1211 23 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1229 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x122f 4 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x1234 6 bytes -
...
Code private_0x0000000002530000:+0x39f4 autoclb.exe:+0x123b 15 bytes -
...
IAT private_0x0000000002530000:+0x39f4 130. entry of autoclb.exe 4 bytes kernel32.dll:GetSystemInfo+0x0 now points to kernel32.dll:+0x10000
...
Host Behavior
File (12)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\CIIHMN~1\AppData\Local\Temp\98F9CE91 desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Windows\system32\c_1252.nls desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 3
Fn
Create Directory C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw - False 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Delete C:\Users\CIIHMN~1\Desktop\WORLDT~1.EXE - True 1
Fn
Registry (121)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER - True 71
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_USERS - True 1
Fn
Open Key HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders - True 1
Fn
Read Value HKEY_CURRENT_USER value_name = Value, data = 0 False 38
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = InstallDate, data = 65 True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = cabilipc, data = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe, type = REG_SZ True 1
Fn
Read Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders value_name = AppData, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders value_name = AppData, data = C:\Users\CIiHmnxMn6Ps\AppData\Roaming, type = REG_SZ True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Process (3)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\svchost.exe os_pid = 0xdd0, creation_flags = CREATE_SUSPENDED, CREATE_DEFAULT_ERROR_MODE, show_window = SW_HIDE True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_SET_SESSIONID, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_DUP_HANDLE, PROCESS_CREATE_PROCESS, PROCESS_SET_QUOTA, PROCESS_SET_INFORMATION, PROCESS_QUERY_INFORMATION, PROCESS_SUSPEND_RESUME, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE True 1
Fn
Thread (6)
»
Operation Process Additional Information Success Count Logfile
Suspend c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe os_tid = 0xd80 True 1
Fn
Get Context c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe os_tid = 0xd80 True 2
Fn
Set Context c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe os_tid = 0xd80 True 1
Fn
Resume c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe os_tid = 0xd80 True 2
Fn
Memory (5)
»
Operation Process Additional Information Success Count Logfile
Allocate C:\Windows\system32\svchost.exe address = 0x2bbf0c0, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 45871292 True 1
Fn
Protect C:\Windows\system32\svchost.exe address = 0x7ff673b43440, protection = PAGE_EXECUTE_READWRITE, size = 45872632 True 1
Fn
Protect C:\Windows\system32\svchost.exe address = 0x7ff673b43000, protection = PAGE_EXECUTE_READ, size = 45872632 True 1
Fn
Write C:\Windows\system32\svchost.exe address = 0xf60000, size = 792 True 1
Fn
Data
Write C:\Windows\system32\svchost.exe address = 0x7ff673b43440, size = 4 True 1
Fn
Data
Module (221)
»
Operation Module Additional Information Success Count Logfile
Load ntdll.dll base_address = 0x77ca0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x77290000 True 1
Fn
Load SETUPAPI.dll base_address = 0x76a90000 True 1
Fn
Load KERNEL32.dll base_address = 0x75260000 True 1
Fn
Load USER32.dll base_address = 0x77150000 True 1
Fn
Load ADVAPI32.dll base_address = 0x76a10000 True 1
Fn
Load SHELL32.dll base_address = 0x75430000 True 1
Fn
Load ole32.dll base_address = 0x768b0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75260000 True 14
Fn
Get Handle c:\windows\syswow64\ntdll.dll base_address = 0x77ca0000 True 19
Fn
Get Handle c:\windows\syswow64\advapi32.dll base_address = 0x76a10000 True 2
Fn
Get Handle c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe base_address = 0x400000 True 4
Fn
Get Handle c:\windows\syswow64\user32.dll base_address = 0x77150000 True 2
Fn
Get Filename - process_name = c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe, file_name_orig = C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe, size = 260 True 3
Fn
Get Filename c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe process_name = c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe, file_name_orig = C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x7527a330 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x75277580 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x75279910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x7527f400 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77cff190 True 8
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77cfa200 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x75279680 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = memset, address_out = 0x77d0ee50 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = strstr, address_out = 0x77d10010 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = mbstowcs, address_out = 0x77d0e610 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlNtStatusToDosError, address_out = 0x77cf3010 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = memcpy, address_out = 0x77d0e7b0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlGetVersion, address_out = 0x77cffcd0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlUnwind, address_out = 0x77cfaca0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwQueryInformationProcess, address_out = 0x77d08d50 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77d08f40 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwOpenProcessToken, address_out = 0x77d09d20 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwQueryInformationToken, address_out = 0x77d08df0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwClose, address_out = 0x77d08cb0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwOpenProcess, address_out = 0x77d08e40 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtUnmapViewOfSection, address_out = 0x77d08e80 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtMapViewOfSection, address_out = 0x77d08e60 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtCreateSection, address_out = 0x77d09080 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlFreeUnicodeString, address_out = 0x77cdb940 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlUpcaseUnicodeString, address_out = 0x77cee040 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = _aulldiv, address_out = 0x77d0c680 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQueryVirtualMemory, address_out = 0x77d08e10 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrStrIA, address_out = 0x772acd10 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrChrW, address_out = 0x772a6a00 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x772a80d0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathCombineW, address_out = 0x772acd50 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionA, address_out = 0x772b1db0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrChrA, address_out = 0x772b26c0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrTrimW, address_out = 0x772a83a0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x772a7c40 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrRChrA, address_out = 0x772b2900 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiGetDeviceRegistryPropertyA, address_out = 0x76ae19a0 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiGetClassDevsA, address_out = 0x76ab8d10 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiEnumDeviceInfo, address_out = 0x76aa5620 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiDestroyDeviceInfoList, address_out = 0x76aa5340 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x752725e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x7527f4b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x752874f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x75279640 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x7527a4b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitThread, address_out = 0x77d02570 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x75285f20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x75279700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapDestroy, address_out = 0x7527d940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapCreate, address_out = 0x75279950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEvent, address_out = 0x752860c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x7529d410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x75286510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x75272d80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x7527e320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SwitchToThread, address_out = 0x75279f30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x752864f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventA, address_out = 0x75285f70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x752862a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTempPathA, address_out = 0x75286410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x75272db0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileA, address_out = 0x75286270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77cdda90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x75277540 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x75277940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetWaitableTimer, address_out = 0x752860d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x752857f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x7529d320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x752861d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x75286170 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareFileTime, address_out = 0x75286130 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResetEvent, address_out = 0x752860b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x75286590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileTime, address_out = 0x75286380 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x752a0960 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x75286150 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x752861b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x75286180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateWaitableTimerA, address_out = 0x7527db30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResumeThread, address_out = 0x7527a280 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SuspendThread, address_out = 0x7527ed00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpA, address_out = 0x7527c1f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynA, address_out = 0x7527f7b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x752787c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsA, address_out = 0x752a0da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x752777b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x75283a30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x7527efc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x75286110 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x752864a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x7527c8c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x75286140 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtectEx, address_out = 0x752a2a00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileA, address_out = 0x75286210 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x7527a040 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x75279560 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSize, address_out = 0x75286360 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x752792b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateRemoteThread, address_out = 0x752a0a00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x75278b70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x75277610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x75278c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x75272af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x75271d90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x7527a300 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLongPathNameW, address_out = 0x752747c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x75286530 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTempFileNameA, address_out = 0x752863f0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfA, address_out = 0x7717ea00 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharUpperA, address_out = 0x771831c0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = FindWindowA, address_out = 0x77180980 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfW, address_out = 0x7717ddf0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x771ccf50 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x76a2ed60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumKeyExA, address_out = 0x76a32520 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyW, address_out = 0x76a2f590 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegDeleteValueW, address_out = 0x76a30ca0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ConvertStringSecurityDescriptorToSecurityDescriptorA, address_out = 0x76a5bda0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x76a2f0a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetSidSubAuthorityCount, address_out = 0x76a30f50 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetSidSubAuthority, address_out = 0x76a30ea0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x76a2ee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyA, address_out = 0x76a331a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExA, address_out = 0x76a30750 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyA, address_out = 0x76a33150 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x76a2ed40 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x76a2efa0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x76a2ee40 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x76a2f000 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteW, address_out = 0x755c4370 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x755c4cb0 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = 92, address_out = 0x756a7560 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x76eadca0 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeEx, address_out = 0x76eacd50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsWow64Process, address_out = 0x752796e0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowThreadProcessId, address_out = 0x7716ba70 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64EnableWow64FsRedirection, address_out = 0x7529b6a0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwWow64QueryInformationProcess64, address_out = 0x77d0a840 True 15
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwWow64ReadVirtualMemory64, address_out = 0x77d0a860 True 1
Fn
Create Mapping - filename = System Paging File, protection = PAGE_READWRITE, SEC_RESERVE, maximum_size = 4194304 True 1
Fn
Create Mapping - protection = PAGE_EXECUTE_READWRITE, maximum_size = 45872600 True 1
Fn
Map - process_name = c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe, desired_access = FILE_MAP_ALL_ACCESS True 1
Fn
Map - process_name = c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x3380000 True 1
Fn
Map - process_name = C:\Windows\system32\svchost.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0xe20000 True 1
Fn
Window (3)
»
Operation Window Name Additional Information Success Count Logfile
Find - class_name = ProgMan True 2
Fn
Set Attribute - index = 18446744073709551596, new_long = 128 False 1
Fn
System (702)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Get Cursor x_out = 480, y_out = 403 True 613
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 10
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Get Time type = System Time, time = 2018-10-30 17:03:49 (UTC) True 46
Fn
Get Time type = System Time, time = 2018-10-30 17:03:50 (UTC) True 24
Fn
Get Time type = System Time, time = 2018-10-30 17:03:52 (UTC) True 1
Fn
Get Time type = Ticks, time = 133359 True 1
Fn
Get Info type = Hardware Information True 1
Fn
Get Info type = Operating System True 1
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION False 1
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Get Info type = Operating System False 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #6: svchost.exe
314 0
»
Information Value
ID #6
File Name c:\windows\system32\svchost.exe
Command Line C:\Windows\system32\svchost.exe
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:58, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:05
OS Process Information
»
Information Value
PID 0xdd0
Parent PID 0xd2c (c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x DD4
0x E14
0x E3C
0x E40
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
pagefile_0x0000000000e20000 0x00e20000 0x00f52fff Pagefile Backed Memory rwx True False False -
private_0x0000000000f60000 0x00f60000 0x00f60fff Private Memory rwx True False False -
private_0x000000007f7c5000 0x7f7c5000 0x7f7c5fff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000e6cce20000 0xe6cce20000 0xe6cce3ffff Private Memory rw True False False -
pagefile_0x000000e6cce20000 0xe6cce20000 0xe6cce2ffff Pagefile Backed Memory rw True False False -
svchost.exe.mui 0xe6cce30000 0xe6cce30fff Memory Mapped File r False False False -
pagefile_0x000000e6cce40000 0xe6cce40000 0xe6cce53fff Pagefile Backed Memory r True False False -
private_0x000000e6cce60000 0xe6cce60000 0xe6ccedffff Private Memory rw True False False -
pagefile_0x000000e6ccee0000 0xe6ccee0000 0xe6ccee3fff Pagefile Backed Memory r True False False -
pagefile_0x000000e6ccef0000 0xe6ccef0000 0xe6ccef0fff Pagefile Backed Memory r True False False -
private_0x000000e6ccf00000 0xe6ccf00000 0xe6ccf01fff Private Memory rw True False False -
locale.nls 0xe6ccf10000 0xe6ccfcdfff Memory Mapped File r False False False -
private_0x000000e6ccfd0000 0xe6ccfd0000 0xe6cd04ffff Private Memory rw True False False -
imm32.dll 0xe6cd050000 0xe6cd083fff Memory Mapped File r False False False -
private_0x000000e6cd050000 0xe6cd050000 0xe6cd050fff Private Memory rw True False False -
private_0x000000e6cd060000 0xe6cd060000 0xe6cd060fff Private Memory rw True False False -
msvfw32.dll.mui 0xe6cd070000 0xe6cd071fff Memory Mapped File r False False False -
private_0x000000e6cd0a0000 0xe6cd0a0000 0xe6cd0a6fff Private Memory rw True False False -
private_0x000000e6cd100000 0xe6cd100000 0xe6cd1fffff Private Memory rw True False False -
private_0x000000e6cd200000 0xe6cd200000 0xe6cd39cfff Private Memory rw True False False -
pagefile_0x000000e6cd200000 0xe6cd200000 0xe6cd387fff Pagefile Backed Memory r True False False -
private_0x000000e6cd390000 0xe6cd390000 0xe6cd39cfff Private Memory rw True False False -
private_0x000000e6cd3a0000 0xe6cd3a0000 0xe6cd59ffff Private Memory rw True False False -
private_0x000000e6cd400000 0xe6cd400000 0xe6cd4fffff Private Memory rw True False False -
pagefile_0x000000e6cd500000 0xe6cd500000 0xe6cd680fff Pagefile Backed Memory r True False False -
pagefile_0x000000e6cd690000 0xe6cd690000 0xe6cea8ffff Pagefile Backed Memory r True False False -
private_0x000000e6cea90000 0xe6cea90000 0xe6ceb7cfff Private Memory rw True False False -
oleaut32.dll 0xe6cea90000 0xe6ceb4cfff Memory Mapped File r False False False -
private_0x000000e6ceb70000 0xe6ceb70000 0xe6ceb7cfff Private Memory rw True False False -
private_0x000000e6ceb80000 0xe6ceb80000 0xe6ced7ffff Private Memory rw True False False -
private_0x000000e6cec00000 0xe6cec00000 0xe6cecfffff Private Memory rw True False False -
private_0x000000e6ced00000 0xe6ced00000 0xe6cee3cfff Private Memory rw True False False -
private_0x000000e6cee40000 0xe6cee40000 0xe6cf03ffff Private Memory rw True False False -
private_0x000000e6cef00000 0xe6cef00000 0xe6ceffffff Private Memory rw True False False -
private_0x000000e6cf000000 0xe6cf000000 0xe6cf1fffff Private Memory rw True False False -
private_0x000000e6cf000000 0xe6cf000000 0xe6cf0fffff Private Memory rw True False False -
private_0x000000e6cf100000 0xe6cf100000 0xe6cf2fffff Private Memory rw True False False -
private_0x000000e6cf100000 0xe6cf100000 0xe6cf1fffff Private Memory rw True False False -
private_0x000000e6cf200000 0xe6cf200000 0xe6cf3fffff Private Memory rw True False False -
private_0x000000e6cf200000 0xe6cf200000 0xe6cf2fffff Private Memory rw True False False -
sortdefault.nls 0xe6cf300000 0xe6cf636fff Memory Mapped File r False False False -
pagefile_0x000000e6cf640000 0xe6cf640000 0xe6cf772fff Pagefile Backed Memory rwx True False False -
pagefile_0x00007df5ff400000 0x7df5ff400000 0x7ff5ff3fffff Pagefile Backed Memory - True False False -
pagefile_0x00007ff672fa0000 0x7ff672fa0000 0x7ff67309ffff Pagefile Backed Memory r True False False -
pagefile_0x00007ff6730a0000 0x7ff6730a0000 0x7ff6730c2fff Pagefile Backed Memory r True False False -
private_0x00007ff6730c4000 0x7ff6730c4000 0x7ff6730c4fff Private Memory rw True False False -
private_0x00007ff6730cc000 0x7ff6730cc000 0x7ff6730cdfff Private Memory rw True False False -
private_0x00007ff6730ce000 0x7ff6730ce000 0x7ff6730cffff Private Memory rw True False False -
svchost.exe 0x7ff673b40000 0x7ff673b4cfff Memory Mapped File rwx False False False -
comctl32.dll 0x7ff8d55b0000 0x7ff8d5659fff Memory Mapped File rwx False False False -
msacm32.dll 0x7ff8d5980000 0x7ff8d599bfff Memory Mapped File rwx False False False -
msvfw32.dll 0x7ff8d5da0000 0x7ff8d5dc8fff Memory Mapped File rwx False False False -
avifil32.dll 0x7ff8da7b0000 0x7ff8da7cffff Memory Mapped File rwx False False False -
winmmbase.dll 0x7ff8db910000 0x7ff8db93bfff Memory Mapped File rwx False False False -
winmm.dll 0x7ff8db940000 0x7ff8db962fff Memory Mapped File rwx False False False -
devobj.dll 0x7ff8e9720000 0x7ff8e9746fff Memory Mapped File rwx False False False -
sspicli.dll 0x7ff8ea9d0000 0x7ff8ea9fbfff Memory Mapped File rwx False False False -
powrprof.dll 0x7ff8eadd0000 0x7ff8eae19fff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x7ff8eae20000 0x7ff8eae2efff Memory Mapped File rwx False False False -
profapi.dll 0x7ff8eae30000 0x7ff8eae42fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x7ff8eaf60000 0x7ff8eafa3fff Memory Mapped File rwx False False False -
windows.storage.dll 0x7ff8eb180000 0x7ff8eb7a7fff Memory Mapped File rwx False False False -
shcore.dll 0x7ff8eb7b0000 0x7ff8eb862fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7ff8eb870000 0x7ff8eba4cfff Memory Mapped File rwx False False False -
user32.dll 0x7ff8ebdc0000 0x7ff8ebf0dfff Memory Mapped File rwx False False False -
msctf.dll 0x7ff8ec0c0000 0x7ff8ec21bfff Memory Mapped File rwx False False False -
sechost.dll 0x7ff8ec240000 0x7ff8ec29afff Memory Mapped File rwx False False False -
ole32.dll 0x7ff8ec300000 0x7ff8ec440fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7ff8ec450000 0x7ff8ec575fff Memory Mapped File rwx False False False -
shell32.dll 0x7ff8ec580000 0x7ff8edaa4fff Memory Mapped File rwx False False False -
gdi32.dll 0x7ff8edbc0000 0x7ff8edd44fff Memory Mapped File rwx False False False -
combase.dll 0x7ff8edd60000 0x7ff8edfdbfff Memory Mapped File rwx False False False -
shlwapi.dll 0x7ff8edfe0000 0x7ff8ee030fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7ff8ee0b0000 0x7ff8ee14cfff Memory Mapped File rwx False False False -
imm32.dll 0x7ff8ee150000 0x7ff8ee185fff Memory Mapped File rwx False False False -
advapi32.dll 0x7ff8ee190000 0x7ff8ee235fff Memory Mapped File rwx False False False -
psapi.dll 0x7ff8ee240000 0x7ff8ee247fff Memory Mapped File rwx False False False -
kernel32.dll 0x7ff8ee2d0000 0x7ff8ee37cfff Memory Mapped File rwx False False False -
ntdll.dll 0x7ff8ee380000 0x7ff8ee541fff Memory Mapped File rwx False False False -
Hook Information
»
Type Installer Target Size Information Actions
Code pagefile_0x0000000000e20000:+0x28dce advapi32.dll:Wow64RedirectKeyPathInternal+0x3fa 8 bytes -
...
Code pagefile_0x0000000000e20000:+0x28dd2 advapi32.dll:Wow64RedirectKeyPathInternal+0x3f4 2 bytes -
...
Code pagefile_0x0000000000e20000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x1fe 8 bytes -
...
Code pagefile_0x0000000000e20000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x1f8 2 bytes -
...
Code pagefile_0x0000000000e20000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x20c 8 bytes -
...
Code pagefile_0x0000000000e20000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x206 2 bytes -
...
Code pagefile_0x0000000000e20000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x21a 8 bytes -
...
Code pagefile_0x0000000000e20000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x214 2 bytes -
...
IAT pagefile_0x0000000000e20000:+0x289b5 261. entry of msctf.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000e20000:+0x315b0
...
IAT pagefile_0x0000000000e20000:+0x289b5 133. entry of msvcrt.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x0000000000e20000:+0x316b8
...
IAT pagefile_0x0000000000e20000:+0x289b5 134. entry of msvcrt.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000e20000:+0x315b0
...
IAT pagefile_0x0000000000e20000:+0x289b5 230. entry of user32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000e20000:+0x315b0
...
IAT pagefile_0x0000000000e20000:+0x289b5 517. entry of ole32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000e20000:+0x315b0
...
IAT pagefile_0x0000000000e20000:+0x289b5 638. entry of shell32.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000000e20000:+0x318ec
...
IAT pagefile_0x0000000000e20000:+0x289b5 631. entry of shell32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000e20000:+0x315b0
...
IAT pagefile_0x0000000000e20000:+0x289b5 236. entry of windows.storage.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000e20000:+0x315b0
...
IAT pagefile_0x0000000000e20000:+0x289b5 215. entry of windows.storage.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000000e20000:+0x318ec
...
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #5: c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe 0xd80 address = 0xe20000, size = 1257472 True 1
Fn
Modify Memory #5: c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe 0xd80 address = 0xf60000, size = 792 True 1
Fn
Data
Modify Control Flow #5: c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe 0xd80 os_tid = 0xdd4, address = 0x730c4000 True 1
Fn
Modify Memory #5: c:\users\ciihmn~1\appdata\roaming\adsldraw\autoclb.exe 0xd80 address = 0x7ff673b43440, size = 4 True 1
Fn
Data
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\SYSTEM32\ntdll.dll desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 3
Fn
Read C:\Windows\SYSTEM32\ntdll.dll size = 4, size_out = 4 True 3
Fn
Data
Registry (12)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Ini, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Client, data = 232, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductID, data = 48 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = 87 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = CurrentVersion, data = 54 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = InstallDate, data = 65 True 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Scr, type = REG_NONE False 1
Fn
Write Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Client, size = 40, type = REG_BINARY True 1
Fn
Data
Process (35)
»
Operation Process Additional Information Success Count Logfile
Get Info c:\windows\system32\svchost.exe type = PROCESS_BASIC_INFORMATION True 34
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_SET_SESSIONID, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_DUP_HANDLE, PROCESS_CREATE_PROCESS, PROCESS_SET_QUOTA, PROCESS_SET_INFORMATION, PROCESS_QUERY_INFORMATION, PROCESS_SUSPEND_RESUME, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE True 1
Fn
Thread (7)
»
Operation Process Additional Information Success Count Logfile
Create c:\windows\explorer.exe proc_address = 0x7ff8ee389fa0, proc_parameter = 0, flags = THREAD_CREATE_SUSPENDED True 1
Fn
Suspend c:\windows\explorer.exe os_tid = 0xe38 True 1
Fn
Get Context c:\windows\explorer.exe os_tid = 0xe38 True 2
Fn
Set Context c:\windows\explorer.exe os_tid = 0xe38 True 1
Fn
Resume c:\windows\explorer.exe os_tid = 0xe38 True 2
Fn
Memory (9)
»
Operation Process Additional Information Success Count Logfile
Allocate c:\windows\explorer.exe address = 0xe6ccede920, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 991280621864 True 1
Fn
Protect c:\windows\explorer.exe address = 0x7ff8ee389fa0, protection = PAGE_EXECUTE_READWRITE, size = 4 True 2
Fn
Protect c:\windows\explorer.exe address = 0x7ff8ee389fa0, protection = PAGE_EXECUTE_READ, size = 4 True 2
Fn
Read c:\windows\explorer.exe address = 0x7ff8ee389fa0, size = 4 True 1
Fn
Data
Write c:\windows\explorer.exe address = 0x7ff8ee389fa0, size = 4 True 2
Fn
Data
Write c:\windows\explorer.exe address = 0x5200000, size = 792 True 1
Fn
Data
Module (227)
»
Operation Module Additional Information Success Count Logfile
Load ntdll.dll base_address = 0x0 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load AVIFIL32.dll base_address = 0x0 True 1
Fn
Load ADVAPI32.dll base_address = 0x7ff8ee190000 True 1
Fn
Load SHLWAPI.dll base_address = 0x7ff8edfe0000 True 1
Fn
Load USER32.dll base_address = 0x7ff8ebdc0000 True 1
Fn
Load PSAPI.DLL base_address = 0x7ff8ee240000 True 1
Fn
Get Handle c:\windows\system32\svchost.exe base_address = 0x7ff673b40000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x7ff8ee2d0000 True 5
Fn
Get Handle c:\windows\system32\ntdll.dll base_address = 0x7ff8ee380000 True 4
Fn
Get Handle c:\windows\system32\kernelbase.dll base_address = 0x7ff8eb870000 True 1
Fn
Get Handle c:\windows\system32\advapi32.dll base_address = 0x7ff8ee190000 True 2
Fn
Get Filename AVIFIL32.dll process_name = c:\windows\system32\svchost.exe, file_name_orig = C:\Windows\system32\svchost.exe, size = 260 True 2
Fn
Get Filename c:\windows\system32\ntdll.dll process_name = c:\windows\system32\svchost.exe, file_name_orig = C:\Windows\SYSTEM32\ntdll.dll, size = 260 True 3
Fn
Get Address - function = NtCreateSection, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = NtUnmapViewOfSection, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = NtMapViewOfSection, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ZwOpenProcessToken, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ZwClose, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ZwQueryInformationToken, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ZwOpenProcess, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = NtQuerySystemInformation, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RtlNtStatusToDosError, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ZwQueryInformationProcess, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RtlImageDirectoryEntryToData, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = _wcsupr, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = _strupr, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = memmove, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = bsearch, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = _vsnwprintf, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = _strlwr, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = atoi, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = strstr, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = wcscpy, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ZwQueryKey, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RtlUpcaseUnicodeString, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RtlFreeUnicodeString, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = sprintf, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = _snprintf, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = memset, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = memcpy, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = strcpy, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RtlAdjustPrivilege, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = mbstowcs, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RtlImageNtHeader, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = memcmp, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = __C_specific_handler, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = __chkstk, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetLocalTime, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = OpenProcess, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = VirtualQueryEx, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateRemoteThread, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetModuleFileNameW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetVersion, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = SetEndOfFile, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RemoveDirectoryW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetTempFileNameA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = DeleteCriticalSection, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = VirtualAlloc, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = VirtualProtect, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CloseHandle, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = WriteProcessMemory, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateFileA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrcmpiA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetModuleFileNameA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = LoadLibraryA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetCurrentProcess, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrcmpA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetModuleHandleA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateFileMappingA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = MapViewOfFile, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = Sleep, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = UnmapViewOfFile, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GlobalLock, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrlenA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GlobalAlloc, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GlobalUnlock, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = HeapAlloc, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrcpyA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetLastError, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = HeapFree, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RemoveDirectoryA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = DeleteFileA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrcatA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = WriteFile, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateDirectoryA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = HeapDestroy, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = HeapCreate, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = SetEvent, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = HeapReAlloc, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetTickCount, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FindNextFileW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CopyFileW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = SetWaitableTimer, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = LocalAlloc, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetCurrentThread, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetCurrentThreadId, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrlenW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetSystemTimeAsFileTime, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateEventA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetWindowsDirectoryA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = DeleteFileW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateDirectoryW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateWaitableTimerA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetTempPathA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FindFirstFileW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = LocalFree, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = TerminateProcess, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = SuspendThread, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = WaitForMultipleObjects, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ResumeThread, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrcpyW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FileTimeToSystemTime, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateThread, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateFileW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ResetEvent, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = SwitchToThread, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrcatW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateProcessW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetFileSize, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetFileAttributesW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ExpandEnvironmentStringsW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = WideCharToMultiByte, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = LeaveCriticalSection, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = SetLastError, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = EnterCriticalSection, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetComputerNameA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateMutexA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = OpenWaitableTimerA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = OpenMutexA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetVolumeInformationA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = WaitForSingleObject, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ReleaseMutex, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetComputerNameW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = InitializeCriticalSection, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = LoadLibraryExW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetProcAddress, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = VirtualFree, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetLogicalDriveStringsW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetFileAttributesA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = OpenFileMappingA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetExitCodeProcess, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateProcessA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrcpynA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = LocalReAlloc, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = TlsAlloc, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = TlsGetValue, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = TlsSetValue, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = LoadLibraryW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetVersionExW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FreeLibrary, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ReadFile, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = SetFilePointer, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = Thread32First, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = QueueUserAPC, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateToolhelp32Snapshot, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = OpenThread, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = Thread32Next, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FindFirstFileA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FindNextFileA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = ConnectNamedPipe, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetOverlappedResult, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CancelIo, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = DisconnectNamedPipe, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FlushFileBuffers, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CallNamedPipeA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = CreateNamedPipeA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetSystemTime, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = WaitNamedPipeA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetCurrentProcessId, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = SleepEx, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RemoveVectoredExceptionHandler, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AddVectoredExceptionHandler, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = OpenEventA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = lstrcmpiW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = RaiseException, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetSystemInfo, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = Process32NextW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = Process32FirstW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = QueueUserWorkItem, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FileTimeToLocalFileTime, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = FindClose, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = GetDriveTypeW, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = VirtualProtectEx, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIStreamRelease, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIStreamWrite, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIFileOpenA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIFileCreateStreamA, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIStreamSetFormat, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIFileExit, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIFileInit, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIMakeCompressedStream, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address - function = AVIFileRelease, ordinal = 0, address_out = 0xe6ccedf790 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsWow64Process, address_out = 0x7ff8ee2ee960 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = ConvertStringSecurityDescriptorToSecurityDescriptorA, address_out = 0x7ff8ee1ad610 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrRChrA, address_out = 0x7ff8edff4dd0 True 1
Fn
Get Address c:\windows\system32\user32.dll function = wsprintfA, address_out = 0x7ff8ebde2610 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyA, address_out = 0x7ff8ee1ab9e0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryValueExA, address_out = 0x7ff8ee1a7dd0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x7ff8ee1a72e0 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrToIntExA, address_out = 0x7ff8edff4e70 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrChrA, address_out = 0x7ff8edff4cc0 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrTrimA, address_out = 0x7ff8edff4e80 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetUserNameA, address_out = 0x7ff8ee1bec40 True 1
Fn
Get Address c:\windows\system32\psapi.dll function = EnumProcessModules, address_out = 0x7ff8ee241040 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrStrIW, address_out = 0x7ff8edfeb260 True 1
Fn
Get Address c:\windows\system32\user32.dll function = GetShellWindow, address_out = 0x7ff8ebde4060 True 1
Fn
Get Address c:\windows\system32\user32.dll function = GetWindowThreadProcessId, address_out = 0x7ff8ebdd4040 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = RtlExitUserThread, address_out = 0x7ff8ee389fa0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCreateKeyA, address_out = 0x7ff8ee1d6dc0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetUserNameW, address_out = 0x7ff8ee1ada40 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegSetValueExA, address_out = 0x7ff8ee192680 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExA, address_out = 0x7ff8ee1a7d70 True 1
Fn
Create Mapping - protection = PAGE_EXECUTE_READWRITE, maximum_size = 991280623296 True 1
Fn
Map - process_name = c:\windows\system32\svchost.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0xe6cf640000 True 1
Fn
Map - process_name = c:\windows\explorer.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0xcfd0000 True 1
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Computer Name - False 1
Fn
Get Computer Name result_out = LHNIWSJ True 2
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Get Time type = Ticks, time = 141328 True 1
Fn
Get Info type = Operating System True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = {F6123870-DDED-9815-178A-614C3B5E2540} True 1
Fn
Process #7: explorer.exe
1180 0
»
Information Value
ID #7
File Name c:\windows\explorer.exe
Command Line C:\Windows\Explorer.EXE
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:01, Reason: Injection
Unmonitor End Time: 00:01:12, Reason: Self Terminated
Monitor Duration 00:00:11
OS Process Information
»
Information Value
PID 0x508
Parent PID 0xffffffffffffffff (Unknown)
Is Created or Modified Executable False
Integrity Level Medium
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x E28
0x E24
0x 340
0x 90C
0x 960
0x 7C8
0x 7E8
0x 95C
0x 974
0x 46C
0x BE0
0x BDC
0x A9C
0x A98
0x A94
0x A90
0x A8C
0x A88
0x A84
0x A78
0x A64
0x A60
0x A18
0x 9E4
0x 9D4
0x 9A8
0x 970
0x 96C
0x 964
0x 958
0x 950
0x 94C
0x 948
0x 940
0x 938
0x 930
0x 92C
0x 928
0x 8FC
0x 8F8
0x 8F4
0x 8F0
0x 8C0
0x 8A4
0x 878
0x 86C
0x 84C
0x 848
0x 844
0x 840
0x 830
0x 82C
0x 810
0x 80C
0x 808
0x 804
0x 5BC
0x 478
0x 5B4
0x 65C
0x 5E8
0x 55C
0x E38
0x E48
0x E4C
0x E50
0x E58
0x E5C
0x E60
0x E64
0x E68
0x E6C
0x E70
0x F68
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
pagefile_0x0000000000dc0000 0x00dc0000 0x00dcffff Pagefile Backed Memory rw True False False -
private_0x0000000000dd0000 0x00dd0000 0x00dd6fff Private Memory rw True False False -
pagefile_0x0000000000de0000 0x00de0000 0x00df3fff Pagefile Backed Memory r True False False -
private_0x0000000000e00000 0x00e00000 0x00e7ffff Private Memory rw True False False -
pagefile_0x0000000000e80000 0x00e80000 0x00e83fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000e90000 0x00e90000 0x00e92fff Pagefile Backed Memory r True False False -
private_0x0000000000ea0000 0x00ea0000 0x00ea1fff Private Memory rw True False False -
locale.nls 0x00eb0000 0x00f6dfff Memory Mapped File r False False False -
pagefile_0x0000000000f70000 0x00f70000 0x00f71fff Pagefile Backed Memory r True False False -
{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000036.db 0x00f80000 0x00f9bfff Memory Mapped File r True False False -
pagefile_0x0000000000fa0000 0x00fa0000 0x00fa2fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000fb0000 0x00fb0000 0x00fb1fff Pagefile Backed Memory r True False False -
private_0x0000000000fc0000 0x00fc0000 0x00fc3fff Private Memory rw True False False -
wscui.cpl.mui 0x00fd0000 0x00fe1fff Memory Mapped File r False False False -
private_0x0000000000ff0000 0x00ff0000 0x00ff6fff Private Memory rw True False False -
explorer.exe.mui 0x01000000 0x01007fff Memory Mapped File r False False False -
private_0x0000000001010000 0x01010000 0x01010fff Private Memory rw True False False -
private_0x0000000001020000 0x01020000 0x01020fff Private Memory rw True False False -
pagefile_0x0000000001030000 0x01030000 0x01030fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001040000 0x01040000 0x01040fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001050000 0x01050000 0x01050fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001060000 0x01060000 0x01060fff Pagefile Backed Memory r True False False -
cversions.1.db 0x01070000 0x01073fff Memory Mapped File r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db 0x01080000 0x01092fff Memory Mapped File r True False False -
private_0x00000000010a0000 0x010a0000 0x0119ffff Private Memory rw True False False -
pagefile_0x00000000011a0000 0x011a0000 0x011a0fff Pagefile Backed Memory rw True False False -
private_0x00000000011b0000 0x011b0000 0x0122ffff Private Memory rw True False False -
{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db 0x01230000 0x0124dfff Memory Mapped File r True False False -
pagefile_0x0000000001250000 0x01250000 0x01252fff Pagefile Backed Memory r True False False -
private_0x0000000001260000 0x01260000 0x0126ffff Private Memory rw True False False -
pagefile_0x0000000001270000 0x01270000 0x01272fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001280000 0x01280000 0x012a9fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000012b0000 0x012b0000 0x012b1fff Pagefile Backed Memory r True False False -
private_0x00000000012c0000 0x012c0000 0x012cffff Private Memory rw True False False -
pagefile_0x00000000012d0000 0x012d0000 0x01457fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001460000 0x01460000 0x015e0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000015f0000 0x015f0000 0x029effff Pagefile Backed Memory r True False False -
sortdefault.nls 0x029f0000 0x02d26fff Memory Mapped File r False False False -
private_0x0000000002d30000 0x02d30000 0x02daffff Private Memory rw True False False -
private_0x0000000002db0000 0x02db0000 0x02e2ffff Private Memory rw True False False -
private_0x0000000002e30000 0x02e30000 0x02eaffff Private Memory rw True False False -
shell32.dll.mui 0x02eb0000 0x02f10fff Memory Mapped File r False False False -
kernelbase.dll.mui 0x02f20000 0x02ffefff Memory Mapped File r False False False -
private_0x0000000003000000 0x03000000 0x0307ffff Private Memory rw True False False -
private_0x0000000003080000 0x03080000 0x030fffff Private Memory rw True False False -
private_0x0000000003100000 0x03100000 0x0317ffff Private Memory rw True False False -
pagefile_0x0000000003180000 0x03180000 0x03181fff Pagefile Backed Memory r True False False -
oleaccrc.dll 0x03190000 0x03191fff Memory Mapped File r False False False -
oleaccrc.dll.mui 0x031a0000 0x031a4fff Memory Mapped File r False False False -
pagefile_0x00000000031b0000 0x031b0000 0x03267fff Pagefile Backed Memory r True False False -
pagefile_0x0000000003270000 0x03270000 0x03273fff Pagefile Backed Memory r True False False -
private_0x0000000003280000 0x03280000 0x0337ffff Private Memory rw True False False -
private_0x0000000003380000 0x03380000 0x0347ffff Private Memory rw True False False -
private_0x0000000003480000 0x03480000 0x03480fff Private Memory rw True False False -
staticcache.dat 0x03490000 0x044cffff Memory Mapped File r False False False -
private_0x00000000044d0000 0x044d0000 0x044d6fff Private Memory rw True False False -
private_0x00000000044e0000 0x044e0000 0x044e0fff Private Memory rw True False False -
private_0x00000000044f0000 0x044f0000 0x044f0fff Private Memory rw True False False -
private_0x0000000004500000 0x04500000 0x04500fff Private Memory rw True False False -
private_0x0000000004510000 0x04510000 0x0458ffff Private Memory rw True False False -
private_0x0000000004590000 0x04590000 0x04591fff Private Memory rw True False False -
private_0x00000000045a0000 0x045a0000 0x045a0fff Private Memory rw True False False -
private_0x00000000045b0000 0x045b0000 0x045b0fff Private Memory rw True False False -
private_0x00000000045c0000 0x045c0000 0x045c0fff Private Memory rw True False False -
pagefile_0x00000000045d0000 0x045d0000 0x045d2fff Pagefile Backed Memory r True False False -
cversions.1.db 0x045e0000 0x045e3fff Memory Mapped File r True False False -
private_0x00000000045f0000 0x045f0000 0x045f0fff Private Memory rw True False False -
pagefile_0x0000000004600000 0x04600000 0x04600fff Pagefile Backed Memory rw True False False -
private_0x0000000004610000 0x04610000 0x04610fff Private Memory rw True False False -
pagefile_0x0000000004620000 0x04620000 0x04622fff Pagefile Backed Memory r True False False -
pagefile_0x0000000004630000 0x04630000 0x04668fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000004670000 0x04670000 0x04672fff Pagefile Backed Memory r True False False -
private_0x0000000004680000 0x04680000 0x04680fff Private Memory rw True False False -
private_0x0000000004690000 0x04690000 0x04690fff Private Memory rw True False False -
private_0x00000000046a0000 0x046a0000 0x0471ffff Private Memory rw True False False -
private_0x0000000004720000 0x04720000 0x0479ffff Private Memory rw True False False -
pagefile_0x00000000047a0000 0x047a0000 0x047a2fff Pagefile Backed Memory r True False False -
cversions.2.db 0x047b0000 0x047b3fff Memory Mapped File r True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db 0x047c0000 0x04802fff Memory Mapped File r True False False -
cversions.2.db 0x04810000 0x04813fff Memory Mapped File r True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db 0x04820000 0x048aafff Memory Mapped File r True False False -
propsys.dll.mui 0x048b0000 0x048c0fff Memory Mapped File r False False False -
private_0x00000000048d0000 0x048d0000 0x0494ffff Private Memory rw True False False -
private_0x0000000004950000 0x04950000 0x049cffff Private Memory rw True False False -
private_0x00000000049d0000 0x049d0000 0x04a4ffff Private Memory rw True False False -
private_0x0000000004a50000 0x04a50000 0x04a50fff Private Memory rw True False False -
private_0x0000000004a60000 0x04a60000 0x04adffff Private Memory rw True False False -
private_0x0000000004ae0000 0x04ae0000 0x04b5ffff Private Memory rw True False False -
private_0x0000000004b60000 0x04b60000 0x04bdffff Private Memory rw True False False -
pagefile_0x0000000004be0000 0x04be0000 0x050d1fff Pagefile Backed Memory rw True False False -
private_0x00000000050e0000 0x050e0000 0x050e0fff Private Memory rw True False False -
thumbcache_idx.db 0x050f0000 0x050f1fff Memory Mapped File rw True False False -
pagefile_0x0000000005100000 0x05100000 0x05100fff Pagefile Backed Memory rw True False False -
thumbcache_idx.db 0x05110000 0x05111fff Memory Mapped File rw True False False -
thumbcache_idx.db 0x05130000 0x05131fff Memory Mapped File rw True False False -
private_0x0000000005140000 0x05140000 0x051bffff Private Memory rw True False False -
iconcache_idx.db 0x051d0000 0x051d1fff Memory Mapped File rw True False False -
pagefile_0x00000000051e0000 0x051e0000 0x051e2fff Pagefile Backed Memory r True False False -
iconcache_idx.db 0x05210000 0x05211fff Memory Mapped File rw True False False -
thumbcache_idx.db 0x05220000 0x05221fff Memory Mapped File rw True False False -
{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db 0x05230000 0x0524bfff Memory Mapped File r True False False -
thumbcache_idx.db 0x05250000 0x05251fff Memory Mapped File rw True False False -
pagefile_0x0000000005260000 0x05260000 0x05262fff Pagefile Backed Memory r True False False -
private_0x0000000005270000 0x05270000 0x052effff Private Memory rw True False False -
private_0x00000000052f0000 0x052f0000 0x0536ffff Private Memory rw True False False -
private_0x0000000005370000 0x05370000 0x053effff Private Memory rw True False False -
private_0x00000000053f0000 0x053f0000 0x0546ffff Private Memory rw True False False -
winnlsres.dll 0x05470000 0x05474fff Memory Mapped File r False False False -
winnlsres.dll.mui 0x05480000 0x0548ffff Memory Mapped File r False False False -
private_0x0000000005490000 0x05490000 0x0550ffff Private Memory rw True False False -
pagefile_0x0000000005510000 0x05510000 0x05510fff Pagefile Backed Memory rw True False False -
private_0x0000000005520000 0x05520000 0x05520fff Private Memory rw True False False -
private_0x0000000005530000 0x05530000 0x05530fff Private Memory rw True False False -
private_0x0000000005540000 0x05540000 0x055bffff Private Memory rw True False False -
mswsock.dll.mui 0x055c0000 0x055c2fff Memory Mapped File r False False False -
iconcache_idx.db 0x055d0000 0x055d1fff Memory Mapped File rw True False False -
iconcache_256.db 0x055e0000 0x055e0fff Memory Mapped File rw True False False -
private_0x00000000055f0000 0x055f0000 0x05deffff Private Memory - True False False -
pagefile_0x0000000005df0000 0x05df0000 0x05df2fff Pagefile Backed Memory r True False False -
private_0x0000000005e00000 0x05e00000 0x05e00fff Private Memory rw True False False -
pagefile_0x0000000005e10000 0x05e10000 0x05e12fff Pagefile Backed Memory r True False False -
private_0x0000000005e20000 0x05e20000 0x05e20fff Private Memory rw True False False -
private_0x0000000005e30000 0x05e30000 0x05e38fff Private Memory rw True False False -
private_0x0000000005e40000 0x05e40000 0x05e43fff Private Memory rw True False False -
windows.storage.dll.mui 0x05e60000 0x05e67fff Memory Mapped File r False False False -
private_0x0000000005e70000 0x05e70000 0x05e78fff Private Memory rw True False False -
private_0x0000000005e80000 0x05e80000 0x05e80fff Private Memory rw True False False -
private_0x0000000005e90000 0x05e90000 0x05efbfff Private Memory rw True False False -
counters.dat 0x05f00000 0x05f00fff Memory Mapped File rw True False False -
private_0x0000000005f10000 0x05f10000 0x05f8ffff Private Memory rw True False False -
private_0x0000000005f90000 0x05f90000 0x0608ffff Private Memory rw True False False -
pagefile_0x0000000006090000 0x06090000 0x06092fff Pagefile Backed Memory r True False False -
pagefile_0x00000000060a0000 0x060a0000 0x060affff Pagefile Backed Memory r True False False -
pagefile_0x00000000060b0000 0x060b0000 0x060b0fff Pagefile Backed Memory rw True False False -
iconcache_idx.db 0x060c0000 0x060c1fff Memory Mapped File rw True False False -
private_0x00000000060f0000 0x060f0000 0x06137fff Private Memory rw True False False -
pagefile_0x0000000006140000 0x06140000 0x0614ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000006150000 0x06150000 0x0615ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000006160000 0x06160000 0x0616ffff Pagefile Backed Memory rw True False False -
stobject.dll.mui 0x06170000 0x06171fff Memory Mapped File r False False False -
private_0x0000000006180000 0x06180000 0x061fffff Private Memory rw True False False -
netmsg.dll 0x06210000 0x06210fff Memory Mapped File r False False False -
netmsg.dll.mui 0x06220000 0x06251fff Memory Mapped File r False False False -
private_0x0000000006260000 0x06260000 0x062dffff Private Memory rw True False False -
thumbcache_48.db 0x062e0000 0x063dffff Memory Mapped File rw True False False -
private_0x0000000006400000 0x06400000 0x06447fff Private Memory rw True False False -
private_0x0000000006450000 0x06450000 0x064cffff Private Memory rw True False False -
private_0x00000000064e0000 0x064e0000 0x0655ffff Private Memory rw True False False -
pagefile_0x0000000006560000 0x06560000 0x06561fff Pagefile Backed Memory r True False False -
grooveintlresource.dll 0x06570000 0x06df2fff Memory Mapped File rwx False False False -
For performance reasons, the remaining 393 entries are omitted.
The remaining entries can be found in flog.txt.
Hook Information
»
Type Installer Target Size Information Actions
Code pagefile_0x000000000cfd0000:+0x28dce kernelbase.dll:ActivatorUpdateForIsRouterChanges+0x146 8 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dd2 kernelbase.dll:ActivatorUpdateForIsRouterChanges+0x140 2 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dce advapi32.dll:Wow64RedirectKeyPathInternal+0x3fa 8 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dd2 advapi32.dll:Wow64RedirectKeyPathInternal+0x3f4 2 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dce advapi32.dll:Wow64RedirectKeyPathInternal+0x408 8 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dd2 advapi32.dll:Wow64RedirectKeyPathInternal+0x402 2 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x1fe 8 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x1f8 2 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x20c 8 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x206 2 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x21a 8 bytes -
...
Code pagefile_0x000000000cfd0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x214 2 bytes -
...
IAT pagefile_0x000000000cfd0000:+0x289b5 530. entry of twinui.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 570. entry of twinui.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 681. entry of explorerframe.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 112. entry of sndvolsso.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 104. entry of sndvolsso.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 98. entry of tokenbroker.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 85. entry of tokenbroker.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 98. entry of settingsynccore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 47. entry of settingsyncpolicy.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 27. entry of capauthz.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 153. entry of twinui.appcore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 116. entry of twinapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 110. entry of coreuicomponents.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 154. entry of wininet.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 166. entry of wininet.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 187. entry of urlmon.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 166. entry of urlmon.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x000000000cfd0000:+0x316b8
...
IAT pagefile_0x000000000cfd0000:+0x289b5 56. entry of wlanapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 109. entry of wdscore.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x000000000cfd0000:+0x316b8
...
IAT pagefile_0x000000000cfd0000:+0x289b5 120. entry of wdscore.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 236. entry of srchadmin.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 236. entry of windows.ui.immersive.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 206. entry of windows.ui.immersive.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 115. entry of iertutil.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 126. entry of iertutil.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 143. entry of iertutil.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 135. entry of mrmcorer.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 50. entry of pcacli.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 56. entry of shacct.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 489. entry of comctl32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 51. entry of msi.dll 4 bytes advapi32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 93. entry of winhttp.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 84. entry of policymanager.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 82. entry of mfplat.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 55. entry of d2d1.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 116. entry of ucrtbase.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 117. entry of ucrtbase.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x000000000cfd0000:+0x316b8
...
IAT pagefile_0x000000000cfd0000:+0x289b5 62. entry of dhcpcsvc.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 30. entry of samlib.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 229. entry of propsys.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 87. entry of mmdevapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 129. entry of es.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 154. entry of es.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 54. entry of bcp47langs.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 92. entry of settingmonitor.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 103. entry of dxgi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 71. entry of d3d11.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 91. entry of dwmapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 39. entry of ninput.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 61. entry of apphelp.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 307. entry of uxtheme.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 126. entry of twinapi.appcore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 39. entry of rmclient.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 93. entry of userenv.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 124. entry of dnsapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 50. entry of powrprof.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 64. entry of profapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 89. entry of cfgmgr32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 236. entry of windows.storage.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 245. entry of windows.storage.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 215. entry of windows.storage.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 113. entry of shcore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 116. entry of oleaut32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 185. entry of setupapi.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 174. entry of setupapi.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 230. entry of user32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 240. entry of user32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 261. entry of msctf.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 41. entry of wldap32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 517. entry of ole32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 550. entry of ole32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 79. entry of rpcrt4.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 668. entry of shell32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 638. entry of shell32.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 631. entry of shell32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 85. entry of clbcatq.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 88. entry of clbcatq.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 220. entry of combase.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 177. entry of shlwapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 133. entry of msvcrt.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x000000000cfd0000:+0x316b8
...
IAT pagefile_0x000000000cfd0000:+0x289b5 134. entry of msvcrt.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 199. entry of advapi32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 129. entry of wer.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 138. entry of wer.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 153. entry of wer.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 44. entry of hcproviders.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 789. entry of explorer.exe 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 808. entry of explorer.exe 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 232. entry of werconcpl.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 39. entry of reagent.dll 4 bytes advapi32.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 167. entry of reagent.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 119. entry of wscapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 19. entry of wscinterop.dll 4 bytes kernel32.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 905. entry of ieframe.dll 4 bytes kernelbase.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 125. entry of ieframe.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 880. entry of ieframe.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 235. entry of hgcpl.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 39. entry of networkstatus.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 134. entry of pnidui.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 142. entry of pnidui.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 277. entry of authui.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 302. entry of authui.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 271. entry of authui.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 154. entry of audioses.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 139. entry of actioncenter.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 2. entry of syncreg.dll 4 bytes advapi32.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 187. entry of shdocvw.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 155. entry of windows.ui.shell.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 91. entry of winspool.drv 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 84. entry of winspool.drv 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x000000000cfd0000:+0x318ec
...
IAT pagefile_0x000000000cfd0000:+0x289b5 160. entry of inputswitch.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 282. entry of stobject.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 268. entry of stobject.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 81. entry of winmmbase.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 110. entry of winmm.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 147. entry of wlidprov.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 112. entry of abovelockapphost.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 69. entry of webio.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 121. entry of windows.networking.connectivity.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 79. entry of profext.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 99. entry of notificationcontroller.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 116. entry of wpncore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 68. entry of provsvc.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 9. entry of filesyncshell64.dll 4 bytes advapi32.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 101. entry of filesyncshell64.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x000000000cfd0000:+0x315b0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 121. entry of thumbcache.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 240. entry of applicationframe.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 283. entry of ntshrui.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 68. entry of wldp.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
IAT pagefile_0x000000000cfd0000:+0x289b5 100. entry of windows.immersiveshell.serviceprovider.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x000000000cfd0000:+0x94d0
...
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Create Remote Thread #6: c:\windows\system32\svchost.exe 0xdd4 address = 0x7ff8ee389fa0 True 1
Fn
Modify Memory #6: c:\windows\system32\svchost.exe 0xdd4 address = 0x7ff8ee389fa0, size = 4 True 2
Fn
Data
Modify Memory #6: c:\windows\system32\svchost.exe 0xdd4 address = 0xcfd0000, size = 1257472 True 1
Fn
Modify Memory #6: c:\windows\system32\svchost.exe 0xdd4 address = 0x5200000, size = 792 True 1
Fn
Data
Modify Control Flow #6: c:\windows\system32\svchost.exe 0xdd4 os_tid = 0xe38, address = 0x0 True 1
Fn
Host Behavior
File (2)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create Pipe \device\namedpipe\{072bb6f5-baec-d114-fc2b-8e95f08fa299} open_mode = PIPE_ACCESS_INBOUND, PIPE_ACCESS_OUTBOUND, FILE_FLAG_OVERLAPPED, pipe_mode = PIPE_TYPE_MESSAGE, max_instances = 255 True 1
Fn
Registry (253)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Ini, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Install, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Client, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductID, data = 48 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = 87 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = CurrentVersion, data = 54 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = InstallDate, data = 65 True 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = {111F6A44-3C4D-6BC7-CED5-30CFE2D96473}, type = REG_NONE False 1
Fn
Read Value - value_name = CheckSetting, type = REG_NONE True 10
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{2374911B-B114-42FE-900D-54F95FEE92E5} value_name = Disabled False 1
Fn
Read Value - value_name = LastKnownState, type = REG_NONE False 3
Fn
Read Value - value_name = CheckSetting, type = REG_NONE False 4
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{96F4A050-7E31-453C-88BE-9634F4E02139} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{AA4C798D-D91B-4B07-A013-787F5803D6FC} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{34A3697E-0F10-4E48-AF3C-F869B5BABEBB} value_name = Disabled False 1
Fn
Read Value - value_name = ActivationType, type = REG_NONE True 5
Fn
Read Value - value_name = Threading, type = REG_NONE True 4
Fn
Read Value - value_name = TrustLevel, type = REG_NONE True 5
Fn
Read Value - value_name = ActivateAsUser, type = REG_NONE False 4
Fn
Read Value TreatAs type = REG_NONE False 15
Fn
Read Value - data = 0 True 27
Fn
Read Value - data = Network List Manager True 1
Fn
Read Value InprocHandler32 - False 15
Fn
Read Value InprocHandler - False 15
Fn
Read Value - data = PSFactoryBuffer True 2
Fn
Read Value - value_name = InprocServer32 False 13
Fn
Read Value - data = C:\Windows\System32\npmproxy.dll True 1
Fn
Read Value - value_name = ThreadingModel, data = Both True 12
Fn
Read Value - data = Sync root manager True 1
Fn
Read Value - data = C:\Windows\System32\shell32.dll True 1
Fn
Read Value - - False 1
Fn
Read Value - data = C:\Windows\system32\dataexchange.dll True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows value_name = DisplayVersion, type = REG_NONE False 6
Fn
Read Value HKEY_CURRENT_USER\Control Panel\Desktop value_name = PaintDesktopVersion, type = REG_NONE True 6
Fn
Read Value - data = Authentication UI Legacy Shutdown Dialog True 1
Fn
Read Value - data = C:\Windows\system32\shutdownux.dll True 1
Fn
Read Value - value_name = ThreadingModel, data = Apartment True 1
Fn
Read Value - value_name = Reason Setting, type = REG_NONE True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoDisconnect False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoDisconnect False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoLogoff False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoLogoff False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings value_name = ShowHibernateOption False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings value_name = ShowSleepOption False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU value_name = NoAUShutdownOption False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsUpdate\AU value_name = NoAUShutdownOption False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU value_name = NoAUAsDefaultShutdownOption False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsUpdate\AU value_name = NoAUAsDefaultShutdownOption False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search value_name = UseApp False 9
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search value_name = SearchboxTaskbarMode, type = REG_NONE True 9
Fn
Read Value - data = Start Menu Cache True 1
Fn
Read Value - data = C:\Windows\system32\shell32.dll True 1
Fn
Read Value - data = Connected Account Services True 1
Fn
Read Value - data = C:\Windows\system32\SettingSyncCore.dll True 1
Fn
Read Value - value_name = ActivateAsUser, type = REG_NONE True 1
Fn
Read Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TokenBroker\DefaultAccount value_name = providerId, type = REG_NONE False 3
Fn
Read Value - data = Identity Store True 1
Fn
Read Value - data = C:\Windows\System32\IDStore.dll True 2
Fn
Read Value - data = Connected User Store True 1
Fn
Read Value W32:00000000000301F2 value_name = VirtualDesktop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Control Panel\Desktop value_name = AutoColorization False 1
Fn
Read Value - data = ShellItem Shell Namespace helper True 1
Fn
Read Value - data = C:\Windows\system32\windows.storage.dll True 1
Fn
Read Value - data = ShellWindows True 1
Fn
Read Value - data = PSOAInterface True 1
Fn
Read Value - data = C:\Windows\System32\oleaut32.dll True 2
Fn
Read Value - type = REG_NONE True 6
Fn
Read Value - data = PSDispatch True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Launcher value_name = AllowAutoAppRestartOnCrash False 2
Fn
Read Value - data = Memory Mapped Cache Mgr True 1
Fn
Read Value - data = C:\Windows\system32\propsys.dll True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GameDVR value_name = VKToggleGameBar, type = REG_NONE False 2
Fn
Read Value - value_name = Threading, type = REG_NONE False 1
Fn
Read Value - value_name = IdentityType, type = REG_NONE True 1
Fn
Read Value - value_name = Permissions, type = REG_NONE True 1
Fn
Read Value - value_name = ServerType, type = REG_NONE True 1
Fn
Read Value - data = C:\Windows\System32\\Windows.StateRepository.dll True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender value_name = DisableAntiSpyware, type = REG_NONE True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection value_name = DisableRealtimeMonitoring, type = REG_NONE False 2
Fn
Write Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings value_name = EnableSPDY3_0, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = {111F6A44-3C4D-6BC7-CED5-30CFE2D96473}, size = 8, type = REG_BINARY True 1
Fn
Data
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = cabilipc, data = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe, size = 118, type = REG_SZ True 1
Fn
Enumerate Values HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Process (647)
»
Operation Process Additional Information Success Count Logfile
Get Info c:\windows\explorer.exe type = PROCESS_BASIC_INFORMATION True 647
Fn
Module (239)
»
Operation Module Additional Information Success Count Logfile
Load ntdll.dll base_address = 0x0 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load AVIFIL32.dll base_address = 0x0 True 1
Fn
Load ADVAPI32.dll base_address = 0x7ff8ee190000 True 1
Fn
Load SHLWAPI.dll base_address = 0x7ff8edfe0000 True 1
Fn
Load USER32.dll base_address = 0x7ff8ebdc0000 True 1
Fn
Load PSAPI.DLL base_address = 0x7ff8ee240000 True 1
Fn
Load ole32.dll base_address = 0x7ff8ec300000 True 1
Fn
Load ADVAPI32.DLL base_address = 0x7ff8ee190000 True 1
Fn
Get Handle Unknown module name base_address = 0x7ff79fdc0000 True 1
Fn
Get Handle KERNEL32.DLL base_address = 0x7ff8ee2d0000 True 5
Fn
Get Handle NTDLL.DLL base_address = 0x7ff8ee380000 True 2
Fn
Get Handle kernelbase base_address = 0x7ff8eb870000 True 2
Fn
Get Handle ADVAPI32.DLL base_address = 0x7ff8ee190000 True 3
Fn
Get Filename AVIFIL32.dll process_name = c:\windows\explorer.exe, file_name_orig = C:\Windows\Explorer.EXE, size = 260 True 2
Fn
Get Address - function = NtCreateSection, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = NtUnmapViewOfSection, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = NtMapViewOfSection, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ZwOpenProcessToken, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ZwClose, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ZwQueryInformationToken, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ZwOpenProcess, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = NtQuerySystemInformation, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RtlNtStatusToDosError, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ZwQueryInformationProcess, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RtlImageDirectoryEntryToData, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = _wcsupr, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = _strupr, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = memmove, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = bsearch, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = _vsnwprintf, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = _strlwr, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = atoi, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = strstr, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = wcscpy, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ZwQueryKey, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RtlUpcaseUnicodeString, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RtlFreeUnicodeString, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = sprintf, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = _snprintf, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = memset, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = memcpy, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = strcpy, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RtlAdjustPrivilege, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = mbstowcs, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RtlImageNtHeader, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = memcmp, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = __C_specific_handler, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = __chkstk, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetLocalTime, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = OpenProcess, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = VirtualQueryEx, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateRemoteThread, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetModuleFileNameW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetVersion, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = SetEndOfFile, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RemoveDirectoryW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetTempFileNameA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = DeleteCriticalSection, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = VirtualAlloc, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = VirtualProtect, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CloseHandle, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = WriteProcessMemory, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateFileA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrcmpiA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetModuleFileNameA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = LoadLibraryA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetCurrentProcess, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrcmpA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetModuleHandleA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateFileMappingA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = MapViewOfFile, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = Sleep, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = UnmapViewOfFile, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GlobalLock, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrlenA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GlobalAlloc, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GlobalUnlock, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = HeapAlloc, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrcpyA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetLastError, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = HeapFree, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RemoveDirectoryA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = DeleteFileA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrcatA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = WriteFile, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateDirectoryA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = HeapDestroy, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = HeapCreate, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = SetEvent, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = HeapReAlloc, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetTickCount, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FindNextFileW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CopyFileW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = SetWaitableTimer, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = LocalAlloc, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetCurrentThread, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetCurrentThreadId, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrlenW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetSystemTimeAsFileTime, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateEventA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetWindowsDirectoryA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = DeleteFileW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateDirectoryW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateWaitableTimerA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetTempPathA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FindFirstFileW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = LocalFree, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = TerminateProcess, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = SuspendThread, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = WaitForMultipleObjects, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ResumeThread, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrcpyW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FileTimeToSystemTime, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateThread, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateFileW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ResetEvent, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = SwitchToThread, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrcatW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateProcessW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetFileSize, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetFileAttributesW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ExpandEnvironmentStringsW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = WideCharToMultiByte, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = LeaveCriticalSection, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = SetLastError, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = EnterCriticalSection, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetComputerNameA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateMutexA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = OpenWaitableTimerA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = OpenMutexA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetVolumeInformationA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = WaitForSingleObject, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ReleaseMutex, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetComputerNameW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = InitializeCriticalSection, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = LoadLibraryExW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetProcAddress, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = VirtualFree, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetLogicalDriveStringsW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetFileAttributesA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = OpenFileMappingA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetExitCodeProcess, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateProcessA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrcpynA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = LocalReAlloc, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = TlsAlloc, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = TlsGetValue, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = TlsSetValue, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = LoadLibraryW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetVersionExW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FreeLibrary, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ReadFile, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = SetFilePointer, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = Thread32First, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = QueueUserAPC, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateToolhelp32Snapshot, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = OpenThread, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = Thread32Next, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FindFirstFileA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FindNextFileA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = ConnectNamedPipe, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetOverlappedResult, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CancelIo, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = DisconnectNamedPipe, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FlushFileBuffers, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CallNamedPipeA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = CreateNamedPipeA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetSystemTime, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = WaitNamedPipeA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetCurrentProcessId, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = SleepEx, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RemoveVectoredExceptionHandler, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AddVectoredExceptionHandler, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = OpenEventA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = lstrcmpiW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = RaiseException, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetSystemInfo, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = Process32NextW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = Process32FirstW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = QueueUserWorkItem, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FileTimeToLocalFileTime, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = FindClose, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = GetDriveTypeW, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = VirtualProtectEx, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIStreamRelease, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIStreamWrite, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIFileOpenA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIFileCreateStreamA, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIStreamSetFormat, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIFileExit, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIFileInit, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIMakeCompressedStream, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address - function = AVIFileRelease, ordinal = 0, address_out = 0x61ffbc0 True 1
Fn
Get Address Unknown module name function = IsWow64Process, address_out = 0x7ff8ee2ee960 True 1
Fn
Get Address Unknown module name function = ConvertStringSecurityDescriptorToSecurityDescriptorA, address_out = 0x7ff8ee1ad610 True 1
Fn
Get Address Unknown module name function = StrRChrA, address_out = 0x7ff8edff4dd0 True 1
Fn
Get Address Unknown module name function = wsprintfA, address_out = 0x7ff8ebde2610 True 1
Fn
Get Address Unknown module name function = RegOpenKeyA, address_out = 0x7ff8ee1ab9e0 True 1
Fn
Get Address Unknown module name function = RegQueryValueExA, address_out = 0x7ff8ee1a7dd0 True 1
Fn
Get Address Unknown module name function = RegCloseKey, address_out = 0x7ff8ee1a72e0 True 1
Fn
Get Address Unknown module name function = StrToIntExA, address_out = 0x7ff8edff4e70 True 1
Fn
Get Address Unknown module name function = StrChrA, address_out = 0x7ff8edff4cc0 True 1
Fn
Get Address Unknown module name function = StrTrimA, address_out = 0x7ff8edff4e80 True 1
Fn
Get Address Unknown module name function = GetUserNameA, address_out = 0x7ff8ee1bec40 True 1
Fn
Get Address Unknown module name function = EnumProcessModules, address_out = 0x7ff8ee241040 True 1
Fn
Get Address Unknown module name function = StrStrIW, address_out = 0x7ff8edfeb260 True 1
Fn
Get Address Unknown module name function = RegEnumValueW, address_out = 0x7ff8ee1a7220 True 1
Fn
Get Address Unknown module name function = RegSetValueExA, address_out = 0x7ff8ee192680 True 1
Fn
Get Address Unknown module name function = RegCreateKeyA, address_out = 0x7ff8ee1d6dc0 True 1
Fn
Get Address Unknown module name function = RegOpenKeyExA, address_out = 0x7ff8ee1a7d70 True 1
Fn
Get Address Unknown module name function = CreateStreamOnHGlobal, address_out = 0x7ff8edd870a0 True 1
Fn
Get Address Unknown module name function = PathFindFileNameA, address_out = 0x7ff8edfecf30 True 1
Fn
Get Address Unknown module name function = SetWindowsHookExA, address_out = 0x7ff8ebdc27a0 True 1
Fn
Get Address Unknown module name function = RegisterClassA, address_out = 0x7ff8ebde1310 True 1
Fn
Get Address Unknown module name function = CreateWindowExA, address_out = 0x7ff8ebde4df0 True 1
Fn
Get Address Unknown module name function = GetWindowLongPtrA, address_out = 0x7ff8ebdccae0 True 1
Fn
Get Address Unknown module name function = DefWindowProcA, address_out = 0x7ff8ee413230 True 1
Fn
Get Address Unknown module name function = SetWindowLongPtrA, address_out = 0x7ff8ebdd61f0 True 1
Fn
Get Address Unknown module name function = GetMessageA, address_out = 0x7ff8ebddaa50 True 1
Fn
Get Address Unknown module name function = TranslateMessage, address_out = 0x7ff8ebdd36a0 True 1
Fn
Get Address Unknown module name function = DispatchMessageA, address_out = 0x7ff8ebde61e0 True 1
Fn
Get Address Unknown module name function = SetClipboardViewer, address_out = 0x7ff8ebdf0de0 True 1
Fn
Get Address Unknown module name function = PostMessageA, address_out = 0x7ff8ebde4900 True 1
Fn
Get Address Unknown module name function = OpenClipboard, address_out = 0x7ff8ebdeb6c0 True 1
Fn
Get Address Unknown module name function = GetClipboardData, address_out = 0x7ff8ebdeaba0 True 1
Fn
Get Address Unknown module name function = CloseClipboard, address_out = 0x7ff8ebdf0920 True 1
Fn
Get Address Unknown module name function = StrCmpIW, address_out = 0x7ff8edfebe50 True 1
Fn
Get Address Unknown module name function = CallNextHookEx, address_out = 0x7ff8ebdd52d0 True 1
Fn
Get Address Unknown module name function = RegSetValueExW, address_out = 0x7ff8ee1a7850 True 1
Fn
Window (2)
»
Operation Window Name Additional Information Success Count Logfile
Create - class_name = {67C589E2-FFD9-6764-3673-CA57D81D8CA1}, wndproc_parameter = 218331264 True 1
Fn
Create - class_name = {BEBDECA2-8399-9824-F633-8A1798DD4C61}, wndproc_parameter = 218330896 True 1
Fn
System (13)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Get Clipboard format = 1 False 1
Fn
Sleep duration = -1 (infinite) False 3
Fn
Get Time type = Ticks, time = 142796 True 1
Fn
Get Time type = System Time, time = 2018-10-30 17:04:02 (UTC) True 1
Fn
Get Time type = Ticks, time = 143375 True 2
Fn
Register Hook type = WH_KEYBOARD_LL, hookproc_address = 0xd00045c True 1
Fn
Get Info type = Operating System True 1
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION False 1
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Mutex (10)
»
Operation Additional Information Success Count Logfile
Create mutex_name = {CEF02F91-D541-3029-CFE2-D96473361DD8} True 1
Fn
Create mutex_name = Local\{6C433A47-DB67-7E7B-C560-3F92C994E3E6} True 1
Fn
Create mutex_name = Local\{FB999B87-1EC7-E503-005F-32E93403862D} True 1
Fn
Create mutex_name = Local\{53667D0F-9637-FD89-3837-2A81EC5BFE45} True 1
Fn
Open mutex_name = Local\{6C433A47-DB67-7E7B-C560-3F92C994E3E6}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE False 1
Fn
Open mutex_name = Local\{FB999B87-1EC7-E503-005F-32E93403862D}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE False 1
Fn
Open mutex_name = Local\{53667D0F-9637-FD89-3837-2A81EC5BFE45}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE False 1
Fn
Open mutex_name = Local\{6C433A47-DB67-7E7B-C560-3F92C994E3E6}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Open mutex_name = Local\{FB999B87-1EC7-E503-005F-32E93403862D}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Open mutex_name = Local\{53667D0F-9637-FD89-3837-2A81EC5BFE45}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Process #8: autoclb.exe
1159 0
»
Information Value
ID #8
File Name c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe
Command Line "C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:02:00, Reason: Autostart
Unmonitor End Time: 00:02:10, Reason: Self Terminated
Monitor Duration 00:00:10
OS Process Information
»
Information Value
PID 0x590
Parent PID 0x810 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level Medium
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 8A0
0x 89C
0x 894
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00023fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
pagefile_0x0000000000040000 0x00040000 0x00053fff Pagefile Backed Memory r True False False -
private_0x0000000000060000 0x00060000 0x0009ffff Private Memory rw True False False -
private_0x0000000000060000 0x00060000 0x00063fff Private Memory rw True False False -
private_0x0000000000070000 0x00070000 0x0016ffff Private Memory rw True False False -
private_0x00000000000a0000 0x000a0000 0x0019ffff Private Memory rw True False False -
private_0x0000000000170000 0x00170000 0x00170fff Private Memory rw True False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory r True False False -
private_0x00000000001c0000 0x001c0000 0x001c1fff Private Memory rw True False False -
private_0x00000000001d0000 0x001d0000 0x0020ffff Private Memory rw True False False -
private_0x0000000000210000 0x00210000 0x00210fff Private Memory rw True False False -
pagefile_0x0000000000220000 0x00220000 0x00221fff Pagefile Backed Memory r True False False -
private_0x0000000000230000 0x00230000 0x0023ffff Private Memory rw True False False -
private_0x0000000000240000 0x00240000 0x00241fff Private Memory rw True False False -
private_0x0000000000250000 0x00250000 0x0025ffff Private Memory rw True False False -
locale.nls 0x00260000 0x0031dfff Memory Mapped File r False False False -
pagefile_0x0000000000320000 0x00320000 0x00321fff Pagefile Backed Memory r True False False -
private_0x0000000000330000 0x00330000 0x003bffff Private Memory rw True False False -
private_0x0000000000330000 0x00330000 0x00333fff Private Memory rw True False False -
private_0x0000000000340000 0x00340000 0x00340fff Private Memory rwx True False False -
private_0x0000000000340000 0x00340000 0x0037ffff Private Memory rw True False False -
private_0x00000000003b0000 0x003b0000 0x003bffff Private Memory rw True False False -
autoclb.exe 0x00400000 0x0054efff Memory Mapped File rwx True True False
...
private_0x0000000000640000 0x00640000 0x0073ffff Private Memory rw True False False -
private_0x0000000000740000 0x00740000 0x0083ffff Private Memory rw True False False -
pagefile_0x0000000000840000 0x00840000 0x009c7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000009d0000 0x009d0000 0x00b50fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000b60000 0x00b60000 0x01f5ffff Pagefile Backed Memory r True False False -
private_0x0000000001f60000 0x01f60000 0x0205ffff Private Memory rw True False False -
private_0x0000000002150000 0x02150000 0x0215ffff Private Memory rw True False False -
private_0x0000000002160000 0x02160000 0x0235ffff Private Memory rw True False False -
private_0x0000000002160000 0x02160000 0x0225ffff Private Memory rw True False False -
private_0x0000000002350000 0x02350000 0x0235ffff Private Memory rw True False False -
pagefile_0x0000000002360000 0x02360000 0x0275ffff Pagefile Backed Memory rw True False False -
private_0x0000000002760000 0x02760000 0x02aeffff Private Memory rwx True False False -
private_0x0000000002af0000 0x02af0000 0x02beffff Private Memory rw True False False -
private_0x0000000002bf0000 0x02bf0000 0x0301ffff Private Memory rw True False False -
sortdefault.nls 0x03020000 0x03356fff Memory Mapped File r False False False -
private_0x0000000003360000 0x03360000 0x03521fff Private Memory rw True False False -
pagefile_0x0000000003360000 0x03360000 0x03492fff Pagefile Backed Memory rwx True False False -
private_0x00000000034a0000 0x034a0000 0x03661fff Private Memory rw True False False -
wow64.dll 0x71310000 0x7135efff Memory Mapped File rwx False False False -
wow64win.dll 0x71360000 0x713d2fff Memory Mapped File rwx False False False -
wow64cpu.dll 0x713e0000 0x713e7fff Memory Mapped File rwx False False False -
devobj.dll 0x74250000 0x74270fff Memory Mapped File rwx False False False -
winsta.dll 0x74280000 0x742c3fff Memory Mapped File rwx False False False -
uxtheme.dll 0x742d0000 0x74344fff Memory Mapped File rwx False False False -
comctl32.dll 0x74350000 0x74558fff Memory Mapped File rwx False False False -
tapi32.dll 0x74560000 0x74593fff Memory Mapped File rwx False False False -
wtsapi32.dll 0x745a0000 0x745aefff Memory Mapped File rwx False False False -
version.dll 0x745b0000 0x745b7fff Memory Mapped File rwx False False False -
comctl32.dll 0x745c0000 0x74651fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74660000 0x746b8fff Memory Mapped File rwx False False False -
cryptbase.dll 0x746c0000 0x746c9fff Memory Mapped File rwx False False False -
sspicli.dll 0x746d0000 0x746edfff Memory Mapped File rwx False False False -
kernelbase.dll 0x746f0000 0x74865fff Memory Mapped File rwx False False False -
windows.storage.dll 0x74870000 0x74d4cfff Memory Mapped File rwx False False False -
advapi32.dll 0x74d50000 0x74dcafff Memory Mapped File rwx False False False -
oleaut32.dll 0x74dd0000 0x74e61fff Memory Mapped File rwx False False False -
profapi.dll 0x74e70000 0x74e7efff Memory Mapped File rwx False False False -
rpcrt4.dll 0x74ee0000 0x74f8bfff Memory Mapped File rwx False False False -
combase.dll 0x74f90000 0x75149fff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x75150000 0x7515bfff Memory Mapped File rwx False False False -
shcore.dll 0x75160000 0x751ecfff Memory Mapped File rwx False False False -
powrprof.dll 0x75330000 0x75373fff Memory Mapped File rwx False False False -
kernel32.dll 0x75380000 0x7546ffff Memory Mapped File rwx False False False -
shell32.dll 0x755e0000 0x7699efff Memory Mapped File rwx False False False -
msasn1.dll 0x769a0000 0x769adfff Memory Mapped File rwx False False False -
crypt32.dll 0x769b0000 0x76b24fff Memory Mapped File rwx False False False -
msctf.dll 0x76b30000 0x76c4ffff Memory Mapped File rwx False False False -
ole32.dll 0x76cb0000 0x76d99fff Memory Mapped File rwx False False False -
sechost.dll 0x76da0000 0x76de2fff Memory Mapped File rwx False False False -
imm32.dll 0x76e50000 0x76e7afff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x76e80000 0x76eb5fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76ed0000 0x76f8dfff Memory Mapped File rwx False False False -
gdi32.dll 0x76fa0000 0x770ecfff Memory Mapped File rwx False False False -
wintrust.dll 0x77100000 0x77141fff Memory Mapped File rwx False False False -
shlwapi.dll 0x77150000 0x77193fff Memory Mapped File rwx False False False -
user32.dll 0x771a0000 0x772dffff Memory Mapped File rwx False False False -
setupapi.dll 0x77410000 0x775b4fff Memory Mapped File rwx False False False -
ntdll.dll 0x775c0000 0x77738fff Memory Mapped File rwx False False False -
pagefile_0x000000007feb0000 0x7feb0000 0x7ffaffff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd5000 0x7ffd5000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffd8000 0x7ffd8000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7ffd58c2ffff Private Memory r True False False -
ntdll.dll 0x7ffd58c30000 0x7ffd58df1fff Memory Mapped File rwx False False False -
private_0x00007ffd58df2000 0x7ffd58df2000 0x7ffffffeffff Private Memory r True False False -
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000002760000:+0x39f4 130. entry of autoclb.exe 4 bytes kernel32.dll:GetSystemInfo+0x0 now points to kernel32.dll:+0x10000
...
Host Behavior
File (11)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\CIIHMN~1\AppData\Local\Temp\98F9CE91 desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Windows\system32\c_1252.nls desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 3
Fn
Create Directory C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw - False 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Get Info C:\Windows\system32\c_1252.nls type = time True 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Registry (121)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER - True 71
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_USERS - True 1
Fn
Open Key HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders - True 1
Fn
Read Value HKEY_CURRENT_USER value_name = Value, data = 0 False 38
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = InstallDate, data = 65 True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = cabilipc, data = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe, type = REG_SZ True 1
Fn
Read Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders value_name = AppData, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders value_name = AppData, data = C:\Users\CIiHmnxMn6Ps\AppData\Roaming, type = REG_SZ True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Enumerate Keys HKEY_USERS - True 1
Fn
Process (3)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\svchost.exe os_pid = 0x910, creation_flags = CREATE_SUSPENDED, CREATE_DEFAULT_ERROR_MODE, show_window = SW_HIDE True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_SET_SESSIONID, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_DUP_HANDLE, PROCESS_CREATE_PROCESS, PROCESS_SET_QUOTA, PROCESS_SET_INFORMATION, PROCESS_QUERY_INFORMATION, PROCESS_SUSPEND_RESUME, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE True 1
Fn
Thread (6)
»
Operation Process Additional Information Success Count Logfile
Suspend c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe os_tid = 0x894 True 1
Fn
Get Context c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe os_tid = 0x894 True 2
Fn
Set Context c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe os_tid = 0x894 True 1
Fn
Resume c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe os_tid = 0x894 True 2
Fn
Memory (4)
»
Operation Process Additional Information Success Count Logfile
Protect C:\Windows\system32\svchost.exe address = 0x7ff64e653440, protection = PAGE_EXECUTE_READWRITE, size = 46069240 True 1
Fn
Protect C:\Windows\system32\svchost.exe address = 0x7ff64e653000, protection = PAGE_EXECUTE_READ, size = 46069240 True 1
Fn
Write C:\Windows\system32\svchost.exe address = 0xf30000, size = 792 True 1
Fn
Data
Write C:\Windows\system32\svchost.exe address = 0x7ff64e653440, size = 4 True 1
Fn
Data
Module (218)
»
Operation Module Additional Information Success Count Logfile
Load ntdll.dll base_address = 0x775c0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x77150000 True 1
Fn
Load SETUPAPI.dll base_address = 0x77410000 True 1
Fn
Load KERNEL32.dll base_address = 0x75380000 True 1
Fn
Load USER32.dll base_address = 0x771a0000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d50000 True 1
Fn
Load SHELL32.dll base_address = 0x755e0000 True 1
Fn
Load ole32.dll base_address = 0x76cb0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75380000 True 13
Fn
Get Handle c:\windows\syswow64\ntdll.dll base_address = 0x775c0000 True 19
Fn
Get Handle c:\windows\syswow64\advapi32.dll base_address = 0x74d50000 True 2
Fn
Get Handle c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe base_address = 0x400000 True 3
Fn
Get Handle c:\windows\syswow64\user32.dll base_address = 0x771a0000 True 2
Fn
Get Filename - process_name = c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe, size = 260 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x7539a330 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x75397580 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x75399910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x7539f400 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x7761f190 True 8
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x7761a200 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x75399680 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = memset, address_out = 0x7762ee50 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = strstr, address_out = 0x77630010 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = mbstowcs, address_out = 0x7762e610 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlNtStatusToDosError, address_out = 0x77613010 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = memcpy, address_out = 0x7762e7b0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlGetVersion, address_out = 0x7761fcd0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlUnwind, address_out = 0x7761aca0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwQueryInformationProcess, address_out = 0x77628d50 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77628f40 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwOpenProcessToken, address_out = 0x77629d20 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwQueryInformationToken, address_out = 0x77628df0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwClose, address_out = 0x77628cb0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwOpenProcess, address_out = 0x77628e40 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtUnmapViewOfSection, address_out = 0x77628e80 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtMapViewOfSection, address_out = 0x77628e60 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtCreateSection, address_out = 0x77629080 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlFreeUnicodeString, address_out = 0x775fb940 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlUpcaseUnicodeString, address_out = 0x7760e040 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = _aulldiv, address_out = 0x7762c680 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQueryVirtualMemory, address_out = 0x77628e10 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrStrIA, address_out = 0x7716cd10 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrChrW, address_out = 0x77166a00 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x771680d0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathCombineW, address_out = 0x7716cd50 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionA, address_out = 0x77171db0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrChrA, address_out = 0x771726c0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrTrimW, address_out = 0x771683a0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x77167c40 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrRChrA, address_out = 0x77172900 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiGetDeviceRegistryPropertyA, address_out = 0x774619a0 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiGetClassDevsA, address_out = 0x77438d10 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiEnumDeviceInfo, address_out = 0x77425620 True 1
Fn
Get Address c:\windows\syswow64\setupapi.dll function = SetupDiDestroyDeviceInfoList, address_out = 0x77425340 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x753925e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x7539f4b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x753a74f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x75399640 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x7539a4b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitThread, address_out = 0x77622570 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x753a5f20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x75399700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapDestroy, address_out = 0x7539d940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapCreate, address_out = 0x75399950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEvent, address_out = 0x753a60c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x753bd410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x753a6510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x75392d80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x7539e320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SwitchToThread, address_out = 0x75399f30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x753a64f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventA, address_out = 0x753a5f70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x753a62a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTempPathA, address_out = 0x753a6410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x75392db0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileA, address_out = 0x753a6270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x775fda90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x75397540 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x75397940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetWaitableTimer, address_out = 0x753a60d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x753a57f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x753bd320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x753a61d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x753a6170 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareFileTime, address_out = 0x753a6130 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResetEvent, address_out = 0x753a60b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x753a6590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileTime, address_out = 0x753a6380 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x753c0960 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x753a6150 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x753a61b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x753a6180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateWaitableTimerA, address_out = 0x7539db30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResumeThread, address_out = 0x7539a280 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SuspendThread, address_out = 0x7539ed00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpA, address_out = 0x7539c1f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynA, address_out = 0x7539f7b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x753987c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsA, address_out = 0x753c0da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x753977b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x753a3a30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x7539efc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x753a6110 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x753a64a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x7539c8c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x753a6140 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtectEx, address_out = 0x753c2a00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileA, address_out = 0x753a6210 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x7539a040 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x75399560 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSize, address_out = 0x753a6360 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x753992b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateRemoteThread, address_out = 0x753c0a00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x75398b70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x75397610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x75398c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x75392af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x75391d90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x7539a300 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLongPathNameW, address_out = 0x753947c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x753a6530 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTempFileNameA, address_out = 0x753a63f0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfA, address_out = 0x771cea00 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharUpperA, address_out = 0x771d31c0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = FindWindowA, address_out = 0x771d0980 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfW, address_out = 0x771cddf0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x7721cf50 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d6ed60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumKeyExA, address_out = 0x74d72520 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyW, address_out = 0x74d6f590 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegDeleteValueW, address_out = 0x74d70ca0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ConvertStringSecurityDescriptorToSecurityDescriptorA, address_out = 0x74d9bda0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d6f0a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetSidSubAuthorityCount, address_out = 0x74d70f50 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetSidSubAuthority, address_out = 0x74d70ea0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x74d6ee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyA, address_out = 0x74d731a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExA, address_out = 0x74d70750 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyA, address_out = 0x74d73150 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x74d6ed40 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d6efa0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x74d6ee40 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x74d6f000 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteW, address_out = 0x75774370 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75774cb0 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = 92, address_out = 0x75857560 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x74ffdca0 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeEx, address_out = 0x74ffcd50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsWow64Process, address_out = 0x753996e0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowThreadProcessId, address_out = 0x771bba70 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64EnableWow64FsRedirection, address_out = 0x753bb6a0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwWow64QueryInformationProcess64, address_out = 0x7762a840 True 15
Fn
Get Address c:\windows\syswow64\ntdll.dll function = ZwWow64ReadVirtualMemory64, address_out = 0x7762a860 True 1
Fn
Create Mapping - filename = System Paging File, protection = PAGE_READWRITE, SEC_RESERVE, maximum_size = 4194304 True 1
Fn
Create Mapping - protection = PAGE_EXECUTE_READWRITE, maximum_size = 46069208 True 1
Fn
Map - process_name = c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe, desired_access = FILE_MAP_ALL_ACCESS True 1
Fn
Map - process_name = c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x3360000 True 1
Fn
Map - process_name = C:\Windows\system32\svchost.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0xdf0000 True 1
Fn
Window (3)
»
Operation Window Name Additional Information Success Count Logfile
Find - class_name = ProgMan True 2
Fn
Set Attribute - index = 18446744073709551596, new_long = 128 False 1
Fn
System (786)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Get Cursor x_out = 258, y_out = 857 True 699
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 10
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Get Time type = System Time, time = 2018-10-30 06:04:59 (UTC) True 70
Fn
Get Time type = System Time, time = 2018-10-30 06:05:01 (UTC) True 1
Fn
Get Time type = Ticks, time = 43156 True 1
Fn
Get Info type = Hardware Information True 1
Fn
Get Info type = Operating System True 1
Fn
Get Info type = Operating System False 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #9: svchost.exe
307 0
»
Information Value
ID #9
File Name c:\windows\system32\svchost.exe
Command Line C:\Windows\system32\svchost.exe
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:02:08, Reason: Child Process
Unmonitor End Time: 00:02:10, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0x910
Parent PID 0x590 (c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 550
0x 44C
0x 2E0
0x 450
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
pagefile_0x0000000000df0000 0x00df0000 0x00f22fff Pagefile Backed Memory rwx True False False -
private_0x0000000000f30000 0x00f30000 0x00f30fff Private Memory rwx True False False -
private_0x000000007fe6f000 0x7fe6f000 0x7fe6ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000ac6ddf0000 0xac6ddf0000 0xac6de0ffff Private Memory rw True False False -
pagefile_0x000000ac6ddf0000 0xac6ddf0000 0xac6ddfffff Pagefile Backed Memory rw True False False -
svchost.exe.mui 0xac6de00000 0xac6de00fff Memory Mapped File r False False False -
pagefile_0x000000ac6de10000 0xac6de10000 0xac6de23fff Pagefile Backed Memory r True False False -
private_0x000000ac6de30000 0xac6de30000 0xac6deaffff Private Memory rw True False False -
pagefile_0x000000ac6deb0000 0xac6deb0000 0xac6deb3fff Pagefile Backed Memory r True False False -
pagefile_0x000000ac6dec0000 0xac6dec0000 0xac6dec0fff Pagefile Backed Memory r True False False -
private_0x000000ac6ded0000 0xac6ded0000 0xac6ded1fff Private Memory rw True False False -
locale.nls 0xac6dee0000 0xac6df9dfff Memory Mapped File r False False False -
private_0x000000ac6dfa0000 0xac6dfa0000 0xac6dfa0fff Private Memory rw True False False -
private_0x000000ac6dfb0000 0xac6dfb0000 0xac6dfb0fff Private Memory rw True False False -
private_0x000000ac6dfc0000 0xac6dfc0000 0xac6dfc6fff Private Memory rw True False False -
msvfw32.dll.mui 0xac6dfd0000 0xac6dfd1fff Memory Mapped File r False False False -
private_0x000000ac6e000000 0xac6e000000 0xac6e0fffff Private Memory rw True False False -
private_0x000000ac6e100000 0xac6e100000 0xac6e17ffff Private Memory rw True False False -
private_0x000000ac6e180000 0xac6e180000 0xac6e1ccfff Private Memory rw True False False -
imm32.dll 0xac6e180000 0xac6e1b3fff Memory Mapped File r False False False -
private_0x000000ac6e1c0000 0xac6e1c0000 0xac6e1ccfff Private Memory rw True False False -
private_0x000000ac6e1d0000 0xac6e1d0000 0xac6e3cffff Private Memory rw True False False -
private_0x000000ac6e200000 0xac6e200000 0xac6e2fffff Private Memory rw True False False -
pagefile_0x000000ac6e300000 0xac6e300000 0xac6e487fff Pagefile Backed Memory r True False False -
pagefile_0x000000ac6e490000 0xac6e490000 0xac6e610fff Pagefile Backed Memory r True False False -
pagefile_0x000000ac6e620000 0xac6e620000 0xac6fa1ffff Pagefile Backed Memory r True False False -
private_0x000000ac6fa20000 0xac6fa20000 0xac6fa7cfff Private Memory rw True False False -
private_0x000000ac6fa80000 0xac6fa80000 0xac6fc7ffff Private Memory rw True False False -
private_0x000000ac6fa80000 0xac6fa80000 0xac6faecfff Private Memory rw True False False -
private_0x000000ac6fb00000 0xac6fb00000 0xac6fbfffff Private Memory rw True False False -
oleaut32.dll 0xac6fc00000 0xac6fcbcfff Memory Mapped File r False False False -
private_0x000000ac6fc00000 0xac6fc00000 0xac6fdfffff Private Memory rw True False False -
private_0x000000ac6fc00000 0xac6fc00000 0xac6fcfffff Private Memory rw True False False -
private_0x000000ac6fd00000 0xac6fd00000 0xac6fefffff Private Memory rw True False False -
private_0x000000ac6fd00000 0xac6fd00000 0xac6fdfffff Private Memory rw True False False -
private_0x000000ac6fe00000 0xac6fe00000 0xac6fffffff Private Memory rw True False False -
private_0x000000ac6fe00000 0xac6fe00000 0xac6fefffff Private Memory rw True False False -
private_0x000000ac6ff00000 0xac6ff00000 0xac700fffff Private Memory rw True False False -
private_0x000000ac6ff00000 0xac6ff00000 0xac6fffffff Private Memory rw True False False -
sortdefault.nls 0xac70000000 0xac70336fff Memory Mapped File r False False False -
pagefile_0x000000ac70340000 0xac70340000 0xac70472fff Pagefile Backed Memory rwx True False False -
pagefile_0x00007df5ff250000 0x7df5ff250000 0x7ff5ff24ffff Pagefile Backed Memory - True False False -
pagefile_0x00007ff64e300000 0x7ff64e300000 0x7ff64e3fffff Pagefile Backed Memory r True False False -
pagefile_0x00007ff64e400000 0x7ff64e400000 0x7ff64e422fff Pagefile Backed Memory r True False False -
private_0x00007ff64e42b000 0x7ff64e42b000 0x7ff64e42cfff Private Memory rw True False False -
private_0x00007ff64e42d000 0x7ff64e42d000 0x7ff64e42efff Private Memory rw True False False -
private_0x00007ff64e42f000 0x7ff64e42f000 0x7ff64e42ffff Private Memory rw True False False -
svchost.exe 0x7ff64e650000 0x7ff64e65cfff Memory Mapped File rwx False False False -
winmmbase.dll 0x7ffd459b0000 0x7ffd459dbfff Memory Mapped File rwx False False False -
winmm.dll 0x7ffd459e0000 0x7ffd45a02fff Memory Mapped File rwx False False False -
comctl32.dll 0x7ffd4e790000 0x7ffd4e839fff Memory Mapped File rwx False False False -
msacm32.dll 0x7ffd51600000 0x7ffd5161bfff Memory Mapped File rwx False False False -
msvfw32.dll 0x7ffd51620000 0x7ffd51648fff Memory Mapped File rwx False False False -
avifil32.dll 0x7ffd53d30000 0x7ffd53d4ffff Memory Mapped File rwx False False False -
devobj.dll 0x7ffd53fd0000 0x7ffd53ff6fff Memory Mapped File rwx False False False -
sspicli.dll 0x7ffd55280000 0x7ffd552abfff Memory Mapped File rwx False False False -
powrprof.dll 0x7ffd55680000 0x7ffd556c9fff Memory Mapped File rwx False False False -
profapi.dll 0x7ffd556d0000 0x7ffd556e2fff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x7ffd556f0000 0x7ffd556fefff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x7ffd55700000 0x7ffd55743fff Memory Mapped File rwx False False False -
windows.storage.dll 0x7ffd55a30000 0x7ffd56057fff Memory Mapped File rwx False False False -
shcore.dll 0x7ffd56060000 0x7ffd56112fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7ffd56120000 0x7ffd562fcfff Memory Mapped File rwx False False False -
kernel32.dll 0x7ffd563e0000 0x7ffd5648cfff Memory Mapped File rwx False False False -
ole32.dll 0x7ffd56490000 0x7ffd565d0fff Memory Mapped File rwx False False False -
gdi32.dll 0x7ffd565e0000 0x7ffd56764fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7ffd56770000 0x7ffd5680cfff Memory Mapped File rwx False False False -
msctf.dll 0x7ffd569e0000 0x7ffd56b3bfff Memory Mapped File rwx False False False -
psapi.dll 0x7ffd56ba0000 0x7ffd56ba7fff Memory Mapped File rwx False False False -
combase.dll 0x7ffd56d80000 0x7ffd56ffbfff Memory Mapped File rwx False False False -
user32.dll 0x7ffd57010000 0x7ffd5715dfff Memory Mapped File rwx False False False -
shell32.dll 0x7ffd57160000 0x7ffd58684fff Memory Mapped File rwx False False False -
shlwapi.dll 0x7ffd58690000 0x7ffd586e0fff Memory Mapped File rwx False False False -
sechost.dll 0x7ffd58840000 0x7ffd5889afff Memory Mapped File rwx False False False -
imm32.dll 0x7ffd588a0000 0x7ffd588d5fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7ffd589a0000 0x7ffd58ac5fff Memory Mapped File rwx False False False -
advapi32.dll 0x7ffd58b80000 0x7ffd58c25fff Memory Mapped File rwx False False False -
ntdll.dll 0x7ffd58c30000 0x7ffd58df1fff Memory Mapped File rwx False False False -
Hook Information
»
Type Installer Target Size Information Actions
Code pagefile_0x0000000000df0000:+0x28dce advapi32.dll:Wow64RedirectKeyPathInternal+0x3fa 8 bytes -
...
Code pagefile_0x0000000000df0000:+0x28dd2 advapi32.dll:Wow64RedirectKeyPathInternal+0x3f4 2 bytes -
...
Code pagefile_0x0000000000df0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x1fe 8 bytes -
...
Code pagefile_0x0000000000df0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x1f8 2 bytes -
...
Code pagefile_0x0000000000df0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x20c 8 bytes -
...
Code pagefile_0x0000000000df0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x206 2 bytes -
...
Code pagefile_0x0000000000df0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x21a 8 bytes -
...
Code pagefile_0x0000000000df0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x214 2 bytes -
...
IAT pagefile_0x0000000000df0000:+0x289b5 261. entry of msctf.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000df0000:+0x315b0
...
IAT pagefile_0x0000000000df0000:+0x289b5 133. entry of msvcrt.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x0000000000df0000:+0x316b8
...
IAT pagefile_0x0000000000df0000:+0x289b5 134. entry of msvcrt.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000df0000:+0x315b0
...
IAT pagefile_0x0000000000df0000:+0x289b5 230. entry of user32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000df0000:+0x315b0
...
IAT pagefile_0x0000000000df0000:+0x289b5 517. entry of ole32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000df0000:+0x315b0
...
IAT pagefile_0x0000000000df0000:+0x289b5 638. entry of shell32.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000000df0000:+0x318ec
...
IAT pagefile_0x0000000000df0000:+0x289b5 631. entry of shell32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000df0000:+0x315b0
...
IAT pagefile_0x0000000000df0000:+0x289b5 236. entry of windows.storage.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000000df0000:+0x315b0
...
IAT pagefile_0x0000000000df0000:+0x289b5 215. entry of windows.storage.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000000df0000:+0x318ec
...
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #8: c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe 0x894 address = 0xdf0000, size = 1257472 True 1
Fn
Modify Memory #8: c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe 0x894 address = 0xf30000, size = 792 True 1
Fn
Data
Modify Control Flow #8: c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe 0x894 os_tid = 0x550, address = 0x4e42f000 True 1
Fn
Modify Memory #8: c:\users\ciihmnxmn6ps\appdata\roaming\adsldraw\autoclb.exe 0x894 address = 0x7ff64e653440, size = 4 True 1
Fn
Data
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\SYSTEM32\ntdll.dll desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 3
Fn
Read C:\Windows\SYSTEM32\ntdll.dll size = 4, size_out = 4 True 3
Fn
Data
Registry (11)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Ini, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Client, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductID, data = 48 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = 87 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = CurrentVersion, data = 54 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = InstallDate, data = 65 True 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Scr, type = REG_NONE False 1
Fn
Process (35)
»
Operation Process Additional Information Success Count Logfile
Get Info c:\windows\system32\svchost.exe type = PROCESS_BASIC_INFORMATION True 34
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_SET_SESSIONID, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_DUP_HANDLE, PROCESS_CREATE_PROCESS, PROCESS_SET_QUOTA, PROCESS_SET_INFORMATION, PROCESS_QUERY_INFORMATION, PROCESS_SUSPEND_RESUME, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE True 1
Fn
Thread (7)
»
Operation Process Additional Information Success Count Logfile
Create c:\windows\explorer.exe proc_address = 0x7ffd58c39fa0, proc_parameter = 0, flags = THREAD_CREATE_SUSPENDED True 1
Fn
Suspend c:\windows\explorer.exe os_tid = 0x2ec True 1
Fn
Get Context c:\windows\explorer.exe os_tid = 0x2ec True 2
Fn
Set Context c:\windows\explorer.exe os_tid = 0x2ec True 1
Fn
Resume c:\windows\explorer.exe os_tid = 0x2ec True 2
Fn
Memory (9)
»
Operation Process Additional Information Success Count Logfile
Allocate c:\windows\explorer.exe address = 0xac6deae950, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 740578486616 True 1
Fn
Protect c:\windows\explorer.exe address = 0x7ffd58c39fa0, protection = PAGE_EXECUTE_READWRITE, size = 4 True 2
Fn
Protect c:\windows\explorer.exe address = 0x7ffd58c39fa0, protection = PAGE_EXECUTE_READ, size = 4 True 2
Fn
Read c:\windows\explorer.exe address = 0x7ffd58c39fa0, size = 4 True 1
Fn
Data
Write c:\windows\explorer.exe address = 0x7ffd58c39fa0, size = 4 True 2
Fn
Data
Write c:\windows\explorer.exe address = 0x9ee0000, size = 792 True 1
Fn
Data
Module (225)
»
Operation Module Additional Information Success Count Logfile
Load ntdll.dll base_address = 0x0 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load AVIFIL32.dll base_address = 0x0 True 1
Fn
Load ADVAPI32.dll base_address = 0x7ffd58b80000 True 1
Fn
Load SHLWAPI.dll base_address = 0x7ffd58690000 True 1
Fn
Load USER32.dll base_address = 0x7ffd57010000 True 1
Fn
Load PSAPI.DLL base_address = 0x7ffd56ba0000 True 1
Fn
Get Handle c:\windows\system32\svchost.exe base_address = 0x7ff64e650000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x7ffd563e0000 True 5
Fn
Get Handle c:\windows\system32\ntdll.dll base_address = 0x7ffd58c30000 True 4
Fn
Get Handle c:\windows\system32\kernelbase.dll base_address = 0x7ffd56120000 True 1
Fn
Get Handle c:\windows\system32\advapi32.dll base_address = 0x7ffd58b80000 True 2
Fn
Get Filename AVIFIL32.dll process_name = c:\windows\system32\svchost.exe, file_name_orig = C:\Windows\system32\svchost.exe, size = 260 True 2
Fn
Get Filename c:\windows\system32\ntdll.dll process_name = c:\windows\system32\svchost.exe, file_name_orig = C:\Windows\SYSTEM32\ntdll.dll, size = 260 True 3
Fn
Get Address - function = NtCreateSection, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = NtUnmapViewOfSection, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = NtMapViewOfSection, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ZwOpenProcessToken, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ZwClose, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ZwQueryInformationToken, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ZwOpenProcess, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = NtQuerySystemInformation, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RtlNtStatusToDosError, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ZwQueryInformationProcess, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RtlImageDirectoryEntryToData, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = _wcsupr, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = _strupr, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = memmove, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = bsearch, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = _vsnwprintf, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = _strlwr, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = atoi, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = strstr, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = wcscpy, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ZwQueryKey, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RtlUpcaseUnicodeString, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RtlFreeUnicodeString, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = sprintf, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = _snprintf, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = memset, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = memcpy, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = strcpy, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RtlAdjustPrivilege, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = mbstowcs, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RtlImageNtHeader, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = memcmp, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = __C_specific_handler, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = __chkstk, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetLocalTime, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = OpenProcess, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = VirtualQueryEx, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateRemoteThread, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetModuleFileNameW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetVersion, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = SetEndOfFile, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RemoveDirectoryW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetTempFileNameA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = DeleteCriticalSection, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = VirtualAlloc, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = VirtualProtect, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CloseHandle, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = WriteProcessMemory, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateFileA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrcmpiA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetModuleFileNameA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = LoadLibraryA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetCurrentProcess, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrcmpA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetModuleHandleA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateFileMappingA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = MapViewOfFile, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = Sleep, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = UnmapViewOfFile, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GlobalLock, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrlenA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GlobalAlloc, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GlobalUnlock, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = HeapAlloc, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrcpyA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetLastError, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = HeapFree, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RemoveDirectoryA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = DeleteFileA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrcatA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = WriteFile, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateDirectoryA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = HeapDestroy, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = HeapCreate, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = SetEvent, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = HeapReAlloc, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetTickCount, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FindNextFileW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CopyFileW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = SetWaitableTimer, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = LocalAlloc, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetCurrentThread, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetCurrentThreadId, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrlenW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetSystemTimeAsFileTime, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateEventA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetWindowsDirectoryA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = DeleteFileW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateDirectoryW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateWaitableTimerA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetTempPathA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FindFirstFileW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = LocalFree, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = TerminateProcess, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = SuspendThread, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = WaitForMultipleObjects, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ResumeThread, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrcpyW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FileTimeToSystemTime, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateThread, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateFileW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ResetEvent, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = SwitchToThread, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrcatW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateProcessW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetFileSize, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetFileAttributesW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ExpandEnvironmentStringsW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = WideCharToMultiByte, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = LeaveCriticalSection, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = SetLastError, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = EnterCriticalSection, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetComputerNameA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateMutexA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = OpenWaitableTimerA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = OpenMutexA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetVolumeInformationA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = WaitForSingleObject, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ReleaseMutex, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetComputerNameW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = InitializeCriticalSection, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = LoadLibraryExW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetProcAddress, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = VirtualFree, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetLogicalDriveStringsW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetFileAttributesA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = OpenFileMappingA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetExitCodeProcess, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateProcessA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrcpynA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = LocalReAlloc, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = TlsAlloc, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = TlsGetValue, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = TlsSetValue, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = LoadLibraryW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetVersionExW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FreeLibrary, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ReadFile, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = SetFilePointer, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = Thread32First, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = QueueUserAPC, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateToolhelp32Snapshot, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = OpenThread, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = Thread32Next, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FindFirstFileA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FindNextFileA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = ConnectNamedPipe, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetOverlappedResult, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CancelIo, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = DisconnectNamedPipe, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FlushFileBuffers, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CallNamedPipeA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = CreateNamedPipeA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetSystemTime, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = WaitNamedPipeA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetCurrentProcessId, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = SleepEx, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RemoveVectoredExceptionHandler, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AddVectoredExceptionHandler, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = OpenEventA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = lstrcmpiW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = RaiseException, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetSystemInfo, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = Process32NextW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = Process32FirstW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = QueueUserWorkItem, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FileTimeToLocalFileTime, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = FindClose, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = GetDriveTypeW, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = VirtualProtectEx, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIStreamRelease, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIStreamWrite, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIFileOpenA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIFileCreateStreamA, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIStreamSetFormat, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIFileExit, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIFileInit, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIMakeCompressedStream, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address - function = AVIFileRelease, ordinal = 0, address_out = 0xac6deaf7c0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsWow64Process, address_out = 0x7ffd563fe960 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = ConvertStringSecurityDescriptorToSecurityDescriptorA, address_out = 0x7ffd58b9d610 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrRChrA, address_out = 0x7ffd586a4dd0 True 1
Fn
Get Address c:\windows\system32\user32.dll function = wsprintfA, address_out = 0x7ffd57032610 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyA, address_out = 0x7ffd58b9b9e0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryValueExA, address_out = 0x7ffd58b97dd0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x7ffd58b972e0 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrToIntExA, address_out = 0x7ffd586a4e70 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrChrA, address_out = 0x7ffd586a4cc0 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrTrimA, address_out = 0x7ffd586a4e80 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetUserNameA, address_out = 0x7ffd58baec40 True 1
Fn
Get Address c:\windows\system32\psapi.dll function = EnumProcessModules, address_out = 0x7ffd56ba1040 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrStrIW, address_out = 0x7ffd5869b260 True 1
Fn
Get Address c:\windows\system32\user32.dll function = GetShellWindow, address_out = 0x7ffd57034060 True 1
Fn
Get Address c:\windows\system32\user32.dll function = GetWindowThreadProcessId, address_out = 0x7ffd57024040 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = RtlExitUserThread, address_out = 0x7ffd58c39fa0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCreateKeyA, address_out = 0x7ffd58bc6dc0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExA, address_out = 0x7ffd58b97d70 True 1
Fn
Create Mapping - protection = PAGE_EXECUTE_READWRITE, maximum_size = 740578488048 True 1
Fn
Map - process_name = c:\windows\system32\svchost.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0xac70340000 True 1
Fn
Map - process_name = c:\windows\explorer.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x9da0000 True 1
Fn
System (4)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 1
Fn
Get Time type = Ticks, time = 49437 True 1
Fn
Get Info type = Operating System True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = {365593F7-1DCB-D8D1-57CA-A18C7B9E6580} True 1
Fn
Process #10: explorer.exe
1394 0
»
Information Value
ID #10
File Name c:\windows\explorer.exe
Command Line C:\Windows\Explorer.EXE
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:02:09, Reason: Injection
Unmonitor End Time: 00:04:26, Reason: Terminated by Timeout
Monitor Duration 00:02:17
OS Process Information
»
Information Value
PID 0x810
Parent PID 0x7e4 (c:\windows\system32\userinit.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 2E8
0x 458
0x 510
0x B98
0x B8C
0x B78
0x B6C
0x B68
0x B4C
0x B48
0x B40
0x B3C
0x B30
0x B28
0x B20
0x B14
0x AF4
0x AE8
0x AE0
0x ADC
0x AD4
0x AD0
0x ACC
0x AC0
0x AB8
0x AB0
0x AAC
0x A98
0x 97C
0x 960
0x 94C
0x 944
0x 940
0x 938
0x 934
0x 930
0x 92C
0x 91C
0x 90C
0x 904
0x 900
0x 8FC
0x 8F4
0x 8F0
0x 8EC
0x 8E0
0x 8DC
0x 8D8
0x 8D4
0x 8C8
0x 8C4
0x 8C0
0x 8BC
0x 890
0x 878
0x 874
0x 870
0x 86C
0x 864
0x 860
0x 85C
0x 858
0x 854
0x 850
0x 84C
0x 844
0x 840
0x 838
0x 830
0x 82C
0x 828
0x 824
0x 820
0x 818
0x 814
0x 2EC
0x 2CC
0x 880
0x 4E0
0x 14C
0x 4FC
0x 9E4
0x BC4
0x B84
0x BE8
0x EC
0x 548
0x 67C
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
pagefile_0x0000000000e30000 0x00e30000 0x00e3ffff Pagefile Backed Memory rw True False False -
private_0x0000000000e40000 0x00e40000 0x00e46fff Private Memory rw True False False -
pagefile_0x0000000000e50000 0x00e50000 0x00e63fff Pagefile Backed Memory r True False False -
private_0x0000000000e70000 0x00e70000 0x00eeffff Private Memory rw True False False -
pagefile_0x0000000000ef0000 0x00ef0000 0x00ef3fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000f00000 0x00f00000 0x00f02fff Pagefile Backed Memory r True False False -
private_0x0000000000f10000 0x00f10000 0x00f11fff Private Memory rw True False False -
locale.nls 0x00f20000 0x00fddfff Memory Mapped File r False False False -
private_0x0000000000fe0000 0x00fe0000 0x0105ffff Private Memory rw True False False -
private_0x0000000001060000 0x01060000 0x01066fff Private Memory rw True False False -
explorer.exe.mui 0x01070000 0x01077fff Memory Mapped File r False False False -
private_0x0000000001080000 0x01080000 0x01080fff Private Memory rw True False False -
private_0x0000000001090000 0x01090000 0x01090fff Private Memory rw True False False -
pagefile_0x00000000010a0000 0x010a0000 0x010a0fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000010b0000 0x010b0000 0x010b0fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000010c0000 0x010c0000 0x010c0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000010d0000 0x010d0000 0x010d0fff Pagefile Backed Memory r True False False -
private_0x00000000010e0000 0x010e0000 0x010effff Private Memory rw True False False -
private_0x00000000010f0000 0x010f0000 0x010fffff Private Memory rw True False False -
private_0x0000000001100000 0x01100000 0x011fffff Private Memory rw True False False -
pagefile_0x0000000001200000 0x01200000 0x01387fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001390000 0x01390000 0x01510fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001520000 0x01520000 0x0291ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x02920000 0x02c56fff Memory Mapped File r False False False -
cversions.1.db 0x02c60000 0x02c63fff Memory Mapped File r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001d.db 0x02c70000 0x02c83fff Memory Mapped File r True False False -
pagefile_0x0000000002c90000 0x02c90000 0x02c90fff Pagefile Backed Memory rw True False False -
private_0x0000000002ca0000 0x02ca0000 0x02d1ffff Private Memory rw True False False -
private_0x0000000002d20000 0x02d20000 0x02d9ffff Private Memory rw True False False -
private_0x0000000002da0000 0x02da0000 0x02e1ffff Private Memory rw True False False -
private_0x0000000002e20000 0x02e20000 0x02e9ffff Private Memory rw True False False -
shell32.dll.mui 0x02ea0000 0x02f00fff Memory Mapped File r False False False -
{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000036.db 0x02f10000 0x02f2bfff Memory Mapped File r True False False -
pagefile_0x0000000002f30000 0x02f30000 0x02f32fff Pagefile Backed Memory r True False False -
pagefile_0x0000000002f40000 0x02f40000 0x02f42fff Pagefile Backed Memory r True False False -
pagefile_0x0000000002f50000 0x02f50000 0x02f79fff Pagefile Backed Memory rw True False False -
kernelbase.dll.mui 0x02f80000 0x0305efff Memory Mapped File r False False False -
private_0x0000000003060000 0x03060000 0x030dffff Private Memory rw True False False -
private_0x00000000030e0000 0x030e0000 0x0315ffff Private Memory rw True False False -
private_0x0000000003160000 0x03160000 0x031dffff Private Memory rw True False False -
pagefile_0x00000000031e0000 0x031e0000 0x031e1fff Pagefile Backed Memory r True False False -
pagefile_0x00000000031f0000 0x031f0000 0x031f1fff Pagefile Backed Memory r True False False -
oleaccrc.dll 0x03200000 0x03201fff Memory Mapped File r False False False -
oleaccrc.dll.mui 0x03210000 0x03214fff Memory Mapped File r False False False -
pagefile_0x0000000003220000 0x03220000 0x032d7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000032e0000 0x032e0000 0x032e3fff Pagefile Backed Memory r True False False -
private_0x00000000032f0000 0x032f0000 0x033effff Private Memory rw True False False -
private_0x00000000033f0000 0x033f0000 0x034effff Private Memory rw True False False -
private_0x00000000034f0000 0x034f0000 0x034f0fff Private Memory rw True False False -
staticcache.dat 0x03500000 0x0453ffff Memory Mapped File r False False False -
private_0x0000000004540000 0x04540000 0x04546fff Private Memory rw True False False -
private_0x0000000004550000 0x04550000 0x04550fff Private Memory rw True False False -
private_0x0000000004560000 0x04560000 0x04560fff Private Memory rw True False False -
private_0x0000000004570000 0x04570000 0x04570fff Private Memory rw True False False -
private_0x0000000004580000 0x04580000 0x045fffff Private Memory rw True False False -
private_0x0000000004600000 0x04600000 0x04601fff Private Memory rw True False False -
private_0x0000000004610000 0x04610000 0x04610fff Private Memory rw True False False -
private_0x0000000004620000 0x04620000 0x04620fff Private Memory rw True False False -
private_0x0000000004630000 0x04630000 0x04630fff Private Memory rw True False False -
pagefile_0x0000000004640000 0x04640000 0x04642fff Pagefile Backed Memory r True False False -
cversions.1.db 0x04650000 0x04653fff Memory Mapped File r True False False -
private_0x0000000004660000 0x04660000 0x04660fff Private Memory rw True False False -
pagefile_0x0000000004670000 0x04670000 0x04670fff Pagefile Backed Memory rw True False False -
private_0x0000000004680000 0x04680000 0x04680fff Private Memory rw True False False -
pagefile_0x0000000004690000 0x04690000 0x04692fff Pagefile Backed Memory r True False False -
pagefile_0x00000000046a0000 0x046a0000 0x046d8fff Pagefile Backed Memory rw True False False -
private_0x00000000046e0000 0x046e0000 0x046e0fff Private Memory rw True False False -
private_0x00000000046f0000 0x046f0000 0x046f0fff Private Memory rw True False False -
pagefile_0x0000000004700000 0x04700000 0x04702fff Pagefile Backed Memory r True False False -
cversions.2.db 0x04710000 0x04713fff Memory Mapped File r True False False -
stobject.dll.mui 0x04720000 0x04721fff Memory Mapped File r False False False -
pagefile_0x0000000004730000 0x04730000 0x04732fff Pagefile Backed Memory r True False False -
inputswitch.dll.mui 0x04740000 0x04741fff Memory Mapped File r False False False -
private_0x0000000004750000 0x04750000 0x04750fff Private Memory rw True False False -
pagefile_0x0000000004760000 0x04760000 0x04762fff Pagefile Backed Memory r True False False -
pagefile_0x0000000004770000 0x04770000 0x04771fff Pagefile Backed Memory r True False False -
sndvolsso.dll.mui 0x04780000 0x04781fff Memory Mapped File r False False False -
private_0x0000000004790000 0x04790000 0x0480ffff Private Memory rw True False False -
private_0x0000000004810000 0x04810000 0x0488ffff Private Memory rw True False False -
pagefile_0x0000000004890000 0x04890000 0x04892fff Pagefile Backed Memory r True False False -
cversions.2.db 0x048a0000 0x048a3fff Memory Mapped File r True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db 0x048b0000 0x048f2fff Memory Mapped File r True False False -
cversions.2.db 0x04900000 0x04903fff Memory Mapped File r True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db 0x04910000 0x0499afff Memory Mapped File r True False False -
propsys.dll.mui 0x049a0000 0x049b0fff Memory Mapped File r False False False -
private_0x00000000049c0000 0x049c0000 0x04a3ffff Private Memory rw True False False -
private_0x0000000004a40000 0x04a40000 0x04abffff Private Memory rw True False False -
private_0x0000000004ac0000 0x04ac0000 0x04b3ffff Private Memory rw True False False -
private_0x0000000004b40000 0x04b40000 0x04b40fff Private Memory rw True False False -
private_0x0000000004b50000 0x04b50000 0x04bcffff Private Memory rw True False False -
private_0x0000000004bd0000 0x04bd0000 0x04c4ffff Private Memory rw True False False -
private_0x0000000004c50000 0x04c50000 0x0544ffff Private Memory - True False False -
pagefile_0x0000000005450000 0x05450000 0x05941fff Pagefile Backed Memory rw True False False -
private_0x0000000005950000 0x05950000 0x05950fff Private Memory rw True False False -
private_0x0000000005960000 0x05960000 0x059dffff Private Memory rw True False False -
private_0x00000000059e0000 0x059e0000 0x05a5ffff Private Memory rw True False False -
iconcache_idx.db 0x05a60000 0x05a61fff Memory Mapped File rw True False False -
iconcache_32.db 0x05a70000 0x05b6ffff Memory Mapped File rw True False False -
private_0x0000000005b70000 0x05b70000 0x05bb7fff Private Memory rw True False False -
private_0x0000000005bc0000 0x05bc0000 0x05c3ffff Private Memory rw True False False -
private_0x0000000005c40000 0x05c40000 0x05cbffff Private Memory rw True False False -
private_0x0000000005cc0000 0x05cc0000 0x05d3ffff Private Memory rw True False False -
windows.storage.dll.mui 0x05d40000 0x05d47fff Memory Mapped File r False False False -
pagefile_0x0000000005d50000 0x05d50000 0x05d52fff Pagefile Backed Memory r True False False -
winnlsres.dll 0x05d60000 0x05d64fff Memory Mapped File r False False False -
winnlsres.dll.mui 0x05d70000 0x05d7ffff Memory Mapped File r False False False -
private_0x0000000005d80000 0x05d80000 0x05dfffff Private Memory rw True False False -
mswsock.dll.mui 0x05e00000 0x05e02fff Memory Mapped File r False False False -
pagefile_0x0000000005e10000 0x05e10000 0x05e10fff Pagefile Backed Memory rw True False False -
private_0x0000000005e20000 0x05e20000 0x05e20fff Private Memory rw True False False -
private_0x0000000005e30000 0x05e30000 0x05e30fff Private Memory rw True False False -
private_0x0000000005e40000 0x05e40000 0x05e4dfff Private Memory rw True False False -
pnidui.dll.mui 0x05e50000 0x05e51fff Memory Mapped File r False False False -
private_0x0000000005e60000 0x05e60000 0x05f5ffff Private Memory rw True False False -
pagefile_0x0000000005f60000 0x05f60000 0x05f62fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005f70000 0x05f70000 0x05f72fff Pagefile Backed Memory r True False False -
bthprops.cpl.mui 0x05f80000 0x05f83fff Memory Mapped File r False False False -
private_0x0000000005f90000 0x05f90000 0x05f90fff Private Memory rw True False False -
private_0x0000000005fa0000 0x05fa0000 0x05fa8fff Private Memory rw True False False -
private_0x0000000005fb0000 0x05fb0000 0x05fb3fff Private Memory rw True False False -
thumbcache_idx.db 0x05fc0000 0x05fc1fff Memory Mapped File rw True False False -
netmsg.dll 0x05fd0000 0x05fd0fff Memory Mapped File r False False False -
private_0x0000000005fe0000 0x05fe0000 0x05fe8fff Private Memory rw True False False -
private_0x0000000005ff0000 0x05ff0000 0x05ff0fff Private Memory rw True False False -
private_0x0000000006000000 0x06000000 0x060fffff Private Memory rw True False False -
pagefile_0x0000000006100000 0x06100000 0x06102fff Pagefile Backed Memory r True False False -
private_0x0000000006110000 0x06110000 0x06157fff Private Memory rw True False False -
private_0x0000000006160000 0x06160000 0x061a7fff Private Memory rw True False False -
thumbcache_48.db 0x061b0000 0x062affff Memory Mapped File rw True False False -
netmsg.dll.mui 0x062b0000 0x062e1fff Memory Mapped File r False False False -
private_0x00000000062f0000 0x062f0000 0x0636ffff Private Memory rw True False False -
iconcache_idx.db 0x06370000 0x06371fff Memory Mapped File rw True False False -
iconcache_48.db 0x06380000 0x0647ffff Memory Mapped File rw True False False -
thumbcache_idx.db 0x06480000 0x06481fff Memory Mapped File rw True False False -
pagefile_0x0000000006490000 0x06490000 0x06492fff Pagefile Backed Memory r True False False -
private_0x00000000064a0000 0x064a0000 0x064a0fff Private Memory rw True False False -
private_0x00000000064b0000 0x064b0000 0x064b0fff Private Memory rw True False False -
pagefile_0x00000000064c0000 0x064c0000 0x064c1fff Pagefile Backed Memory r True False False -
thumbcache_idx.db 0x064d0000 0x064d1fff Memory Mapped File rw True False False -
thumbcache_idx.db 0x064e0000 0x064e1fff Memory Mapped File rw True False False -
pagefile_0x00000000064f0000 0x064f0000 0x064f0fff Pagefile Backed Memory rw True False False -
private_0x0000000006500000 0x06500000 0x0657ffff Private Memory rw True False False -
iconcache_idx.db 0x06580000 0x06581fff Memory Mapped File rw True False False -
private_0x0000000006590000 0x06590000 0x0660ffff Private Memory rw True False False -
thumbcache_idx.db 0x06610000 0x06611fff Memory Mapped File rw True False False -
iconcache_48.db 0x06620000 0x0671ffff Memory Mapped File rw True False False -
thumbcache_48.db 0x06720000 0x0681ffff Memory Mapped File rw True False False -
private_0x0000000006820000 0x06820000 0x0689ffff Private Memory rw True False False -
private_0x00000000068a0000 0x068a0000 0x068e8fff Private Memory rw True False False -
private_0x00000000068f0000 0x068f0000 0x0696ffff Private Memory rw True False False -
For performance reasons, the remaining 376 entries are omitted.
The remaining entries can be found in flog.txt.
Hook Information
»
Type Installer Target Size Information Actions
Code pagefile_0x0000000009da0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x1fe 8 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x1f8 2 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x20c 8 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x206 2 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dce kernel32.dll:AslpImageRvaToVa+0x21a 8 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dd2 kernel32.dll:AslpImageRvaToVa+0x214 2 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dce advapi32.dll:Wow64RedirectKeyPathInternal+0x3fa 8 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dd2 advapi32.dll:Wow64RedirectKeyPathInternal+0x3f4 2 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dce advapi32.dll:Wow64RedirectKeyPathInternal+0x408 8 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dd2 advapi32.dll:Wow64RedirectKeyPathInternal+0x402 2 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dce kernelbase.dll:ActivatorUpdateForIsRouterChanges+0x146 8 bytes -
...
Code pagefile_0x0000000009da0000:+0x28dd2 kernelbase.dll:ActivatorUpdateForIsRouterChanges+0x140 2 bytes -
...
IAT pagefile_0x0000000009da0000:+0x289b5 79. entry of rpcrt4.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 85. entry of clbcatq.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 88. entry of clbcatq.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 199. entry of advapi32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 789. entry of explorer.exe 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 808. entry of explorer.exe 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 134. entry of pnidui.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 142. entry of pnidui.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 277. entry of authui.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 302. entry of authui.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 271. entry of authui.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 154. entry of audioses.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 139. entry of actioncenter.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 2. entry of syncreg.dll 4 bytes advapi32.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 187. entry of shdocvw.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 91. entry of winspool.drv 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 84. entry of winspool.drv 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 155. entry of windows.ui.shell.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 282. entry of stobject.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 268. entry of stobject.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 81. entry of winmmbase.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 110. entry of winmm.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 147. entry of wlidprov.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 121. entry of windows.networking.connectivity.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 99. entry of notificationcontroller.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 116. entry of wpncore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 68. entry of provsvc.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 9. entry of filesyncshell64.dll 4 bytes advapi32.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 101. entry of filesyncshell64.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 121. entry of thumbcache.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 283. entry of ntshrui.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 240. entry of applicationframe.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 153. entry of twinui.appcore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 68. entry of wldp.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 100. entry of windows.immersiveshell.serviceprovider.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 530. entry of twinui.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 570. entry of twinui.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 681. entry of explorerframe.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 112. entry of sndvolsso.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 104. entry of sndvolsso.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 47. entry of settingsyncpolicy.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 116. entry of twinapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 79. entry of profext.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 98. entry of tokenbroker.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 85. entry of tokenbroker.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 98. entry of settingsynccore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 110. entry of coreuicomponents.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 69. entry of webio.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 112. entry of abovelockapphost.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 187. entry of urlmon.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 166. entry of urlmon.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x0000000009da0000:+0x316b8
...
IAT pagefile_0x0000000009da0000:+0x289b5 51. entry of msi.dll 4 bytes advapi32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 154. entry of wininet.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 166. entry of wininet.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 56. entry of wlanapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 160. entry of inputswitch.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 39. entry of networkstatus.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 489. entry of comctl32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 93. entry of winhttp.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 92. entry of settingmonitor.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 56. entry of shacct.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 84. entry of policymanager.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 82. entry of mfplat.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 116. entry of ucrtbase.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 117. entry of ucrtbase.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x0000000009da0000:+0x316b8
...
IAT pagefile_0x0000000009da0000:+0x289b5 55. entry of d2d1.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 236. entry of windows.ui.immersive.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 206. entry of windows.ui.immersive.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 115. entry of iertutil.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 126. entry of iertutil.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 143. entry of iertutil.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 135. entry of mrmcorer.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 235. entry of hgcpl.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 62. entry of dhcpcsvc.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 30. entry of samlib.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 229. entry of propsys.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 87. entry of mmdevapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 129. entry of es.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 154. entry of es.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 103. entry of dxgi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 71. entry of d3d11.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 91. entry of dwmapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 39. entry of ninput.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 54. entry of bcp47langs.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 236. entry of srchadmin.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 61. entry of apphelp.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 307. entry of uxtheme.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 126. entry of twinapi.appcore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 39. entry of rmclient.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 93. entry of userenv.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 124. entry of dnsapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 50. entry of powrprof.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 64. entry of profapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 89. entry of cfgmgr32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 236. entry of windows.storage.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 245. entry of windows.storage.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 215. entry of windows.storage.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 113. entry of shcore.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 517. entry of ole32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 550. entry of ole32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 133. entry of msvcrt.dll 4 bytes kernel32.dll:CreateProcessA+0x0 now points to pagefile_0x0000000009da0000:+0x316b8
...
IAT pagefile_0x0000000009da0000:+0x289b5 134. entry of msvcrt.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 185. entry of setupapi.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 174. entry of setupapi.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 261. entry of msctf.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 41. entry of wldap32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 220. entry of combase.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 230. entry of user32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 240. entry of user32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 668. entry of shell32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 638. entry of shell32.dll 4 bytes kernel32.dll:CreateProcessAsUserW+0x0 now points to pagefile_0x0000000009da0000:+0x318ec
...
IAT pagefile_0x0000000009da0000:+0x289b5 631. entry of shell32.dll 4 bytes kernel32.dll:CreateProcessW+0x0 now points to pagefile_0x0000000009da0000:+0x315b0
...
IAT pagefile_0x0000000009da0000:+0x289b5 177. entry of shlwapi.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
IAT pagefile_0x0000000009da0000:+0x289b5 116. entry of oleaut32.dll 4 bytes kernelbase.dll:RegGetValueW+0x0 now points to pagefile_0x0000000009da0000:+0x94d0
...
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Create Remote Thread #9: c:\windows\system32\svchost.exe 0x550 address = 0x7ffd58c39fa0 True 1
Fn
Modify Memory #9: c:\windows\system32\svchost.exe 0x550 address = 0x7ffd58c39fa0, size = 4 True 2
Fn
Data
Modify Memory #9: c:\windows\system32\svchost.exe 0x550 address = 0x9da0000, size = 1257472 True 1
Fn
Modify Memory #9: c:\windows\system32\svchost.exe 0x550 address = 0x9ee0000, size = 792 True 1
Fn
Data
Modify Control Flow #9: c:\windows\system32\svchost.exe 0x550 os_tid = 0x2ec, address = 0x0 True 1
Fn
Host Behavior
File (2)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create Pipe pipe\{072bb6f5-baec-d114-fc2b-8e95f08fa299} open_mode = PIPE_ACCESS_INBOUND, PIPE_ACCESS_OUTBOUND, FILE_FLAG_OVERLAPPED, pipe_mode = PIPE_TYPE_MESSAGE, max_instances = 255 True 1
Fn
Registry (537)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Ini, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Install, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = Client, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductID, data = 48 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = 87 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = CurrentVersion, data = 54 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = InstallDate, data = 65 True 1
Fn
Read Value HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 value_name = {111F6A44-3C4D-6BC7-CED5-30CFE2D96473}, type = REG_BINARY True 2
Fn
Data
Read Value TreatAs type = REG_NONE False 29
Fn
Read Value - data = 0 True 50
Fn
Read Value - data = psfactorybuffer True 1
Fn
Read Value - value_name = InprocServer32 False 25
Fn
Read Value - data = C:\Windows\System32\BitsProxy.dll True 1
Fn
Read Value - value_name = ThreadingModel, data = both True 1
Fn
Read Value InprocHandler32 - False 29
Fn
Read Value InprocHandler - False 29
Fn
Read Value - data = ShellItem Shell Namespace helper True 1
Fn
Read Value - data = C:\Windows\system32\windows.storage.dll True 4
Fn
Read Value - value_name = ThreadingModel, data = Both True 14
Fn
Read Value - data = Immersive Shell True 2
Fn
Read Value - data = PSFactoryBuffer True 3
Fn
Read Value - data = C:\Windows\System32\ActXPrxy.dll True 1
Fn
Read Value - - False 4
Fn
Read Value - data = C:\Windows\system32\windowscodecs.dll True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows value_name = DisplayVersion, type = REG_NONE False 55
Fn
Read Value HKEY_CURRENT_USER\Control Panel\Desktop value_name = PaintDesktopVersion, type = REG_NONE True 55
Fn
Read Value - data = Shared Task Scheduler True 2
Fn
Read Value - value_name = ThreadingModel, data = Apartment True 7
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace value_name = ValidateRegItems False 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace value_name = MonitorRegistry, data = 1 True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace value_name = ValidateRegItems False 16
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace value_name = MonitorRegistry False 16
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached value_name = {9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF} {000214E6-0000-0000-C000-000000000046} 0xFFFF, type = REG_NONE True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions value_name = HasFlushedShellExtCache, type = REG_NONE True 1
Fn
Read Value - data = Sync Center Folder True 1
Fn
Read Value - data = C:\Windows\System32\SyncCenter.dll True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace value_name = ValidateRegItems False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace value_name = MonitorRegistry False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders value_name = StorageDelegateSuppressionPolicy, type = REG_NONE True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders value_name = StorageDelegate, type = REG_NONE True 1
Fn
Read Value - data = Shell File System Folder True 1
Fn
Read Value - data = C:\Windows\system32\Windows.Storage.dll True 1
Fn
Read Value - value_name = UIStatus, type = REG_NONE True 1
Fn
Read Value - value_name = OnlyMember, type = REG_NONE True 1
Fn
Read Value - data = This PC True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace value_name = ValidateRegItems False 5
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace value_name = MonitorRegistry False 5
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\RemovableDrives value_name = ValidateRegItems False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\RemovableDrives value_name = MonitorRegistry False 1
Fn
Read Value Storage value_name = FilterMask, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value_name = NeverShowDrivesMask, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value_name = HideDrivesWithNoMedia, type = REG_NONE False 1
Fn
Read Value - data = Property System Both Class Factory True 1
Fn
Read Value - data = C:\Windows\system32\propsys.dll True 2
Fn
Read Value - type = REG_NONE False 2
Fn
Read Value - data = Local Thumbnail Cache True 1
Fn
Read Value - data = C:\Windows\System32\thumbcache.dll True 2
Fn
Read Value - data = Windows Search Platform True 1
Fn
Read Value - data = Home Group Member Status True 1
Fn
Read Value - data = C:\Windows\System32\provsvc.dll True 1
Fn
Read Value - data = Thumbnail Cache Class Factory for Out of Proc Server True 1
Fn
Read Value - data = Shell Oplock Provider True 1
Fn
Read Value - data = C:\Windows\system32\shcore.dll True 1
Fn
Read Value - value_name = ActivationType, type = REG_NONE True 3
Fn
Read Value - value_name = Threading, type = REG_NONE True 3
Fn
Read Value - value_name = TrustLevel, type = REG_NONE True 3
Fn
Read Value - value_name = ActivateAsUser, type = REG_NONE False 3
Fn
Read Value - data = Network List Manager True 1
Fn
Read Value - data = Windows.Networking.Connectivity.ProxyStubFactory True 1
Fn
Read Value - data = C:\Windows\System32\Windows.Networking.Connectivity.dll True 1
Fn
Read Value - data = Sync root manager True 1
Fn
Read Value - data = C:\Windows\System32\shell32.dll True 1
Fn
Read Value - data = C:\Windows\System32\npmproxy.dll True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\COM\{9DAC2C1E-7C5C-40EB-833B-323E85A1CE84} value_name = Disabled False 1
Fn
Read Value - data = C:\Windows\System32\wscinterop.dll True 1
Fn
Read Value - value_name = CheckSetting, type = REG_NONE True 38
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\COM\{CA236752-2E77-4386-B63B-0E34774A413D} value_name = Disabled False 1
Fn
Read Value - data = C:\Windows\System32\werconcpl.dll True 1
Fn
Read Value - value_name = Disabled, type = REG_NONE True 3
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\COM\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4} value_name = Disabled False 1
Fn
Read Value - data = User Account Control Check Provider True 1
Fn
Read Value - data = C:\Windows\System32\hcproviders.dll True 4
Fn
Read Value - value_name = ThreadingModel, data = Free True 3
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System value_name = EnableLUA, type = REG_NONE True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System value_name = ConsentPromptBehaviorAdmin, type = REG_NONE True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System value_name = PromptOnSecureDesktop, type = REG_NONE True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\COM\{088E8DFB-2464-4C21-BAD2-F0AA6DB5D4BC} value_name = Disabled False 1
Fn
Read Value - data = SmartScreen Settings Check Provider True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System value_name = EnableSmartScreen, type = REG_NONE False 2
Fn
Read Value - value_name = SmartScreenEnabled, type = REG_NONE True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\COM\{D26DE5C1-C061-43F7-9C40-7517526CF1C1} value_name = Disabled False 1
Fn
Read Value - data = Startup App Check Provider True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\StartupNotify value_name = EnableStartupAppNotification, type = REG_NONE True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\COM\{6AE07DC1-0244-4C6F-9AB0-5017A56357C3} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{01979c6a-42fa-414c-b8aa-eee2c8202018} value_name = Disabled False 1
Fn
Read Value - value_name = LastKnownState, type = REG_NONE False 5
Fn
Read Value - data = User Account Control Check Service True 1
Fn
Read Value - value_name = CheckSetting, type = REG_NONE False 6
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78} value_name = Disabled False 1
Fn
Read Value - value_name = LastKnownState, type = REG_NONE True 4
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{A5268B8E-7DB5-465b-BAB7-BDCDA39A394A} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{DE7B24EA-73C8-4A09-985D-5BDADCFA9017} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{134EA407-755D-4A93-B8A6-F290CD155023} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{B447B4DB-7780-11E0-ADA3-18A90531A85A} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{2374911B-B114-42FE-900D-54F95FEE92E5} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{96F4A050-7E31-453C-88BE-9634F4E02139} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{AA4C798D-D91B-4B07-A013-787F5803D6FC} value_name = Disabled False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog\{34A3697E-0F10-4E48-AF3C-F869B5BABEBB} value_name = Disabled False 1
Fn
Write Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings value_name = EnableSPDY3_0, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Enumerate Values HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Process (583)
»
Operation Process Additional Information Success Count Logfile
Get Info c:\windows\explorer.exe type = PROCESS_BASIC_INFORMATION True 583
Fn
Module (237)
»
Operation Module Additional Information Success Count Logfile
Load ntdll.dll base_address = 0x0 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load AVIFIL32.dll base_address = 0x0 True 1
Fn
Load ADVAPI32.dll base_address = 0x7ffd58b80000 True 1
Fn
Load SHLWAPI.dll base_address = 0x7ffd58690000 True 1
Fn
Load USER32.dll base_address = 0x7ffd57010000 True 1
Fn
Load PSAPI.DLL base_address = 0x7ffd56ba0000 True 1
Fn
Load ole32.dll base_address = 0x7ffd56490000 True 1
Fn
Load ADVAPI32.DLL base_address = 0x7ffd58b80000 True 1
Fn
Get Handle Unknown module name base_address = 0x7ff70c660000 True 1
Fn
Get Handle KERNEL32.DLL base_address = 0x7ffd563e0000 True 5
Fn
Get Handle NTDLL.DLL base_address = 0x7ffd58c30000 True 2
Fn
Get Handle kernelbase base_address = 0x7ffd56120000 True 2
Fn
Get Handle ADVAPI32.DLL base_address = 0x7ffd58b80000 True 3
Fn
Get Filename AVIFIL32.dll process_name = c:\windows\explorer.exe, file_name_orig = C:\Windows\Explorer.EXE, size = 260 True 2
Fn
Get Address - function = NtCreateSection, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = NtUnmapViewOfSection, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = NtMapViewOfSection, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ZwOpenProcessToken, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ZwClose, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ZwQueryInformationToken, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ZwOpenProcess, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = NtQuerySystemInformation, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RtlNtStatusToDosError, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ZwQueryInformationProcess, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RtlImageDirectoryEntryToData, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = _wcsupr, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = _strupr, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = memmove, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = bsearch, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = _vsnwprintf, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = _strlwr, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = atoi, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = strstr, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = wcscpy, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ZwQueryKey, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RtlUpcaseUnicodeString, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RtlFreeUnicodeString, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = sprintf, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = _snprintf, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = memset, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = memcpy, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = strcpy, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RtlAdjustPrivilege, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = mbstowcs, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RtlImageNtHeader, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = memcmp, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = __C_specific_handler, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = __chkstk, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetLocalTime, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = OpenProcess, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = VirtualQueryEx, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateRemoteThread, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetModuleFileNameW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetVersion, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = SetEndOfFile, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RemoveDirectoryW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetTempFileNameA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = DeleteCriticalSection, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = VirtualAlloc, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = VirtualProtect, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CloseHandle, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = WriteProcessMemory, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateFileA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrcmpiA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetModuleFileNameA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = LoadLibraryA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetCurrentProcess, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrcmpA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetModuleHandleA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateFileMappingA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = MapViewOfFile, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = Sleep, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = UnmapViewOfFile, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GlobalLock, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrlenA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GlobalAlloc, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GlobalUnlock, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = HeapAlloc, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrcpyA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetLastError, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = HeapFree, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RemoveDirectoryA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = DeleteFileA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrcatA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = WriteFile, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateDirectoryA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = HeapDestroy, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = HeapCreate, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = SetEvent, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = HeapReAlloc, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetTickCount, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FindNextFileW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CopyFileW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = SetWaitableTimer, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = LocalAlloc, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetCurrentThread, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetCurrentThreadId, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrlenW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetSystemTimeAsFileTime, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateEventA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetWindowsDirectoryA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = DeleteFileW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateDirectoryW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateWaitableTimerA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetTempPathA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FindFirstFileW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = LocalFree, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = TerminateProcess, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = SuspendThread, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = WaitForMultipleObjects, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ResumeThread, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrcpyW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FileTimeToSystemTime, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateThread, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateFileW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ResetEvent, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = SwitchToThread, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrcatW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateProcessW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetFileSize, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetFileAttributesW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ExpandEnvironmentStringsW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = WideCharToMultiByte, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = LeaveCriticalSection, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = SetLastError, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = EnterCriticalSection, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetComputerNameA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateMutexA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = OpenWaitableTimerA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = OpenMutexA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetVolumeInformationA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = WaitForSingleObject, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ReleaseMutex, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetComputerNameW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = InitializeCriticalSection, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = LoadLibraryExW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetProcAddress, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = VirtualFree, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetLogicalDriveStringsW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetFileAttributesA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = OpenFileMappingA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetExitCodeProcess, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateProcessA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrcpynA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = LocalReAlloc, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = TlsAlloc, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = TlsGetValue, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = TlsSetValue, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = LoadLibraryW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetVersionExW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FreeLibrary, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ReadFile, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = SetFilePointer, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = Thread32First, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = QueueUserAPC, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateToolhelp32Snapshot, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = OpenThread, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = Thread32Next, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FindFirstFileA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FindNextFileA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = ConnectNamedPipe, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetOverlappedResult, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CancelIo, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = DisconnectNamedPipe, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FlushFileBuffers, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CallNamedPipeA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = CreateNamedPipeA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetSystemTime, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = WaitNamedPipeA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetCurrentProcessId, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = SleepEx, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RemoveVectoredExceptionHandler, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AddVectoredExceptionHandler, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = OpenEventA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = lstrcmpiW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = RaiseException, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetSystemInfo, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = Process32NextW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = Process32FirstW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = QueueUserWorkItem, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FileTimeToLocalFileTime, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = FindClose, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = GetDriveTypeW, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = VirtualProtectEx, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIStreamRelease, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIStreamWrite, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIFileOpenA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIFileCreateStreamA, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIStreamSetFormat, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIFileExit, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIFileInit, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIMakeCompressedStream, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address - function = AVIFileRelease, ordinal = 0, address_out = 0x9d9fcb0 True 1
Fn
Get Address Unknown module name function = IsWow64Process, address_out = 0x7ffd563fe960 True 1
Fn
Get Address Unknown module name function = ConvertStringSecurityDescriptorToSecurityDescriptorA, address_out = 0x7ffd58b9d610 True 1
Fn
Get Address Unknown module name function = StrRChrA, address_out = 0x7ffd586a4dd0 True 1
Fn
Get Address Unknown module name function = wsprintfA, address_out = 0x7ffd57032610 True 1
Fn
Get Address Unknown module name function = RegOpenKeyA, address_out = 0x7ffd58b9b9e0 True 1
Fn
Get Address Unknown module name function = RegQueryValueExA, address_out = 0x7ffd58b97dd0 True 1
Fn
Get Address Unknown module name function = RegCloseKey, address_out = 0x7ffd58b972e0 True 1
Fn
Get Address Unknown module name function = StrToIntExA, address_out = 0x7ffd586a4e70 True 1
Fn
Get Address Unknown module name function = StrChrA, address_out = 0x7ffd586a4cc0 True 1
Fn
Get Address Unknown module name function = StrTrimA, address_out = 0x7ffd586a4e80 True 1
Fn
Get Address Unknown module name function = GetUserNameA, address_out = 0x7ffd58baec40 True 1
Fn
Get Address Unknown module name function = EnumProcessModules, address_out = 0x7ffd56ba1040 True 1
Fn
Get Address Unknown module name function = StrStrIW, address_out = 0x7ffd5869b260 True 1
Fn
Get Address Unknown module name function = RegEnumValueW, address_out = 0x7ffd58b97220 True 1
Fn
Get Address Unknown module name function = RegSetValueExA, address_out = 0x7ffd58b82680 True 1
Fn
Get Address Unknown module name function = RegCreateKeyA, address_out = 0x7ffd58bc6dc0 True 1
Fn
Get Address Unknown module name function = RegOpenKeyExA, address_out = 0x7ffd58b97d70 True 1
Fn
Get Address Unknown module name function = CreateStreamOnHGlobal, address_out = 0x7ffd56da70a0 True 1
Fn
Get Address Unknown module name function = PathFindFileNameA, address_out = 0x7ffd5869cf30 True 1
Fn
Get Address Unknown module name function = SetWindowsHookExA, address_out = 0x7ffd570127a0 True 1
Fn
Get Address Unknown module name function = RegisterClassA, address_out = 0x7ffd57031310 True 1
Fn
Get Address Unknown module name function = CreateWindowExA, address_out = 0x7ffd57034df0 True 1
Fn
Get Address Unknown module name function = GetWindowLongPtrA, address_out = 0x7ffd5701cae0 True 1
Fn
Get Address Unknown module name function = DefWindowProcA, address_out = 0x7ffd58cc3230 True 1
Fn
Get Address Unknown module name function = SetWindowLongPtrA, address_out = 0x7ffd570261f0 True 1
Fn
Get Address Unknown module name function = GetMessageA, address_out = 0x7ffd5702aa50 True 1
Fn
Get Address Unknown module name function = TranslateMessage, address_out = 0x7ffd570236a0 True 1
Fn
Get Address Unknown module name function = DispatchMessageA, address_out = 0x7ffd570361e0 True 1
Fn
Get Address Unknown module name function = SetClipboardViewer, address_out = 0x7ffd57040de0 True 1
Fn
Get Address Unknown module name function = PostMessageA, address_out = 0x7ffd57034900 True 1
Fn
Get Address Unknown module name function = OpenClipboard, address_out = 0x7ffd5703b6c0 True 1
Fn
Get Address Unknown module name function = GetClipboardData, address_out = 0x7ffd5703aba0 True 1
Fn
Get Address Unknown module name function = CloseClipboard, address_out = 0x7ffd57040920 True 1
Fn
Get Address Unknown module name function = StrCmpIW, address_out = 0x7ffd5869be50 True 1
Fn
Window (2)
»
Operation Window Name Additional Information Success Count Logfile
Create - class_name = {B0393975-7C50-236F-7902-BD561384F7F8}, wndproc_parameter = 165705856 True 1
Fn
Create - class_name = {A4513401-FD6C-D9DB-C57E-C9923F60E394}, wndproc_parameter = 165705488 True 1
Fn
System (11)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Get Clipboard format = 1 False 1
Fn
Sleep duration = -1 (infinite) False 3
Fn
Get Time type = Ticks, time = 49953 True 1
Fn
Get Time type = System Time, time = 2018-10-30 06:05:08 (UTC) True 1
Fn
Get Time type = Ticks, time = 50218 True 2
Fn
Register Hook type = WH_KEYBOARD_LL, hookproc_address = 0x9dd045c True 1
Fn
Get Info type = Operating System True 1
Fn
Mutex (10)
»
Operation Additional Information Success Count Logfile
Create mutex_name = {36482DDE-1D22-D83C-57CA-A18C7B9E6580} True 1
Fn
Create mutex_name = Local\{6C433A47-DB67-7E7B-C560-3F92C994E3E6} True 1
Fn
Create mutex_name = Local\{FB999B87-1EC7-E503-005F-32E93403862D} True 1
Fn
Create mutex_name = Local\{53667D0F-9637-FD89-3837-2A81EC5BFE45} True 1
Fn
Open mutex_name = Local\{6C433A47-DB67-7E7B-C560-3F92C994E3E6}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE False 1
Fn
Open mutex_name = Local\{FB999B87-1EC7-E503-005F-32E93403862D}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE False 1
Fn
Open mutex_name = Local\{53667D0F-9637-FD89-3837-2A81EC5BFE45}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE False 1
Fn
Open mutex_name = Local\{6C433A47-DB67-7E7B-C560-3F92C994E3E6}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Open mutex_name = Local\{FB999B87-1EC7-E503-005F-32E93403862D}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Open mutex_name = Local\{53667D0F-9637-FD89-3837-2A81EC5BFE45}, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image