Analysis Report

Monitored Processes

Behavior Information - Grouped by Category

Process #1: tax tool.exe

(Host: 212, Network: 0)

Information	Value
ID / OS PID	#1 / 0x990
OS Parent PID	0x7cc (c:\windows\explorer.exe)
Initial Working Directory	C:\Users\WI2yhmtI onvScY7Pe\Desktop
File Name	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe
Command Line	"C:\Users\WI2yhmtI onvScY7Pe\Desktop\Tax Tool.exe"
Monitor	Start Time: 00:00:37, Reason: Analysis Target
Unmonitor	End Time: 00:01:09, Reason: Terminated
Monitor Duration	00:00:32
OS Thread IDs	#1 0x7BC #2 0x9EC

Region

Name	Start VA	End VA	Type	Permissions	Actions
Tax Tool.exe	0x00140000	0x00163fff	Memory Mapped File	Readable, Writable, Executable	Region Actions Download
private_0x0000000000820000	0x00820000	0x0083ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000820000	0x00820000	0x0082ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000830000	0x00830000	0x00833fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000840000	0x00840000	0x00841fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000840000	0x00840000	0x00840fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000850000	0x00850000	0x00863fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000870000	0x00870000	0x008affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000008b0000	0x008b0000	0x009affff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000009b0000	0x009b0000	0x009b3fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000009c0000	0x009c0000	0x009c1fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000009d0000	0x009d0000	0x00a0ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000a10000	0x00a10000	0x00a10fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000a20000	0x00a20000	0x00a20fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000a70000	0x00a70000	0x00a7ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000af0000	0x00af0000	0x00beffff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x00bf0000	0x00cadfff	Memory Mapped File	Readable	Region Actions
private_0x0000000000cb0000	0x00cb0000	0x00daffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000dd0000	0x00dd0000	0x00e5ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000e60000	0x00e60000	0x00fe7fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001050000	0x01050000	0x0105ffff	Private Memory	Readable, Writable	Region Actions
SortDefault.nls	0x01060000	0x01396fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000013a0000	0x013a0000	0x01520fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001530000	0x01530000	0x0292ffff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002930000	0x02930000	0x02a2ffff	Private Memory	Readable, Writable	Region Actions
wow64win.dll	0x64da0000	0x64e12fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64.dll	0x64e20000	0x64e6efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64cpu.dll	0x64e70000	0x64e77fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x74320000	0x74347fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
secur32.dll	0x74350000	0x74359fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x74360000	0x7438efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcrypt.dll	0x74390000	0x743aafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x743b0000	0x743c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apphelp.dll	0x743d0000	0x74460fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcryptprimitives.dll	0x74470000	0x744c8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x744d0000	0x744d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x744e0000	0x744fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x745a0000	0x7465dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x74660000	0x747acfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x747b0000	0x75b6efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x75b70000	0x75c1bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x75dd0000	0x75f0ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x75f10000	0x75f15fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
windows.storage.dll	0x75f20000	0x763fcfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x76460000	0x7654ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x76800000	0x768e9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x769c0000	0x76adffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x76ae0000	0x76b23fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x76d70000	0x76deafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
SHCore.dll	0x76df0000	0x76e7cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel.appcore.dll	0x76e80000	0x76e8bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x76e90000	0x76ed2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
KernelBase.dll	0x76fa0000	0x77115fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
combase.dll	0x77120000	0x772d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x77340000	0x7734efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x77350000	0x7737afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
powrprof.dll	0x77380000	0x773c3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x773d0000	0x77548fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000000007f700000	0x7f700000	0x7f7fffff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x000000007f800000	0x7f800000	0x7f822fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f828000	0x7f828000	0x7f82afff	Private Memory	Readable, Writable	Region Actions
private_0x000000007f82b000	0x7f82b000	0x7f82dfff	Private Memory	Readable, Writable	Region Actions
private_0x000000007f82e000	0x7f82e000	0x7f82efff	Private Memory	Readable, Writable	Region Actions
private_0x000000007f82f000	0x7f82f000	0x7f82ffff	Private Memory	Readable, Writable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
private_0x000000007fff0000	0x7fff0000	0x7ffd2ef5ffff	Private Memory	Readable	Region Actions
ntdll.dll	0x7ffd2ef60000	0x7ffd2f121fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x00007ffd2f122000	0x7ffd2f122000	0x7ffffffeffff	Private Memory	Readable	Region Actions

Created Files

Filename	File Size	Hash Values	Actions
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\desktop (create shortcut).igb	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\windows powershell (x86).ezu	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	121.50 KB (124416 bytes)	MD5: 212ba96c626898e00e140d5fb3230dd8 SHA1: 204764a6e5f7b2426274da728ee07927b813f68d SHA256: ec2504089edf0330d58433079b2a5f72c102582c399ad73c59777ee03363929a	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	0.26 KB (265 bytes)	MD5: 598227eaf10572cd3a519f5036e3a0f8 SHA1: 5f972be1d9fed9292fdae2ab04017c234d2d96ee SHA256: 67f1199a2804f65f9da317e82adf318953870e237558170e741e33820e8da33f	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	0.52 KB (529 bytes)	MD5: 683dd5a2c796055086e0a367add3c5b4 SHA1: 4c548cc2706fb6d3e9e5dfea1cbeb8921eb40844 SHA256: 13416446403affb8e7f4e9db34e92143101e496cef63c2f6c1d019c6c85cdba2	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	1.08 KB (1103 bytes)	MD5: 384efe8afe27bc20f037cbc8d84a7691 SHA1: 73d0c5fbb0a2687f0feddb000ca256ab4f43fdc9 SHA256: 73c3acdb9d33f60409d9a83ca7204a118e7b8f38fc2638d6c6a621806c2df20c	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	1.33 KB (1361 bytes)	MD5: fde195c534195cb7fb9366b18301668f SHA1: b98f70d52a2cf9c05d4d4a1c52599e8e45f14b9f SHA256: 09c6cc653ac2cce1552324e4b17e2e11ef7c85c1f90918261b718ba31bf1f1d9	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	1.89 KB (1935 bytes)	MD5: 0e2b555664f17266cf3b5420d4aba348 SHA1: 84c5723a050d3dcb65a460fb5b534a1977b00b72 SHA256: 190e2657688962f9bf414088e992b5f318a99044ba57418f112ecd78433b7d98	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	2.14 KB (2193 bytes)	MD5: 40dc3af609187270c9b1f4bf6786aa91 SHA1: 47f557a9eb55f13ce9ca3b1aa0a6e6ff02b3ab9e SHA256: 816326cc557001348409dc0492eea41b428b2728b2e458b65ae1fe8b463d42f9	File Actions Show Properties Download
c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	0.20 KB (208 bytes)	MD5: 3215eb29677705de660def9e4273ba00 SHA1: c82c24651b98844badc03c6f260427f0b71b4ee3 SHA256: 20e9f42ac7c3ed26c39fd332f57fc1fd8a140c95b33b69a1b4f9f6c8a98eb24d	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	2.39 KB (2451 bytes)	MD5: d324f1fd479c2bacebc213132aff5e9b SHA1: d4f7e27c169e61fd97bc902febacab1130591774 SHA256: ab9bfe1d9a700437dbaceaf589895ab78d4a19335adb93cbcb41894d03cd86c3	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	2.65 KB (2709 bytes)	MD5: 9e56e008f2a7f27a1c9301f58b73a1fb SHA1: e74bd51e9a5b3be896f19f4a12f31c581d0f6ddf SHA256: d2001b0365dddaac19598d06b9912fb3ed9804b4f0a00f5170c464e19c0a7b7f	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	2.90 KB (2967 bytes)	MD5: f42069389087f040bd6f6ecaf0fe6f4f SHA1: cfe0ddda7548662df2da7cd897c8b0f069166819 SHA256: 327ebeb1a3f76d7c36ccb582a619f895ea2c76534b475ca9981e49b6ca430e4c	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	3.15 KB (3225 bytes)	MD5: 2c2967db418be7858ce35e21caa1918a SHA1: 5b04283d55662eb4bd4cf9e323d09463b67d1f7a SHA256: 10f558a3e37bc36222252c81203bcae7a3cc2e7ada6ff3d95648fb3730458e03	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	3.40 KB (3485 bytes)	MD5: 3e472ff90aad21bb3e5a8bc2c8648302 SHA1: fc4e97d91d56edf29ada45ae1d984d88739e7abf SHA256: 1470ff8273b2d3e7bf490d044594eab83b5af7e1e6d45241677bf6e01e0b7128	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	3.66 KB (3743 bytes)	MD5: 7a245ac97a224505665b541cbaeebee3 SHA1: fb77de1a8006c5cc48493e21778c03e9b7e190d0 SHA256: 62cd74f35b09b3aeba6cecef7202838b2f064346ae2497e7726c3f419acb2495	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	0.29 KB (300 bytes)	MD5: f6a13797c4a7fbf5afc403b328c1e8c5 SHA1: 486f070991d6efbc629e37826f0e5ffd8d6dd57c SHA256: 243f8a051986749e2377b8af05b0acd4f85b610ecbdd6f4aedf750972882f6a6	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	0.54 KB (558 bytes)	MD5: ffc3df0ebee342a4e3356e9f3c0e85be SHA1: d79aeb7c0083ade7c81985fec2e6b49937d7ec4d SHA256: 713134ae03876de50ec03084726e1eafb2294dde6d6a47fbea86aa3958c1511d	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	0.76 KB (782 bytes)	MD5: db2175e7cf910e0e24821d456ebb7585 SHA1: 5a102942a1cbac3fadfd9649cb428dbd75352aed SHA256: 590375cde13ff61855b82b293ceb3c9f58c9c4efd5c0fb24bf0a779cab9943af	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	1.02 KB (1040 bytes)	MD5: fbb0a72ea8e09554941663de29329a40 SHA1: 1f840d739104c7cd342dfd629f6c933ab4a105a0 SHA256: 487e26636554e2e99bbe89c2eebe1b4b852a8392e28d29e8923ce1d824d21d95	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	1.26 KB (1294 bytes)	MD5: 5e28fab2d35f061f70502561be1f1df2 SHA1: 663a2e078f393dbd5b86894776f7fd259c00b539 SHA256: 6036dd202571a297e7508fe51edbfd25b7836fdc6809d97ad0b56cd73cf0e426	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	1.55 KB (1584 bytes)	MD5: 64b1e0834f2346514bb4433aedc1016b SHA1: 53683915912ba78c08c3f0937b74effa06c108d9 SHA256: b0a1869b21a956ba18b8f7c8b5e0cb8ae6c95b26bd29bd218b6b92cfa183cedf	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	1.80 KB (1842 bytes)	MD5: f97e6372c6d29955ddf7c416f3708cc6 SHA1: e8a70512be9513c5fbb4d6d1d87be4b094816afe SHA256: 0176cfe6bd77c649d36fbc85cf2c49eb6f8247ce1a70eec642bc2f0ccf8aa8bc	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	2.03 KB (2080 bytes)	MD5: 9d681634feb1c951ea4059f5e10b523a SHA1: 6be62c7771daced861cca5df6959b88d5e5ccfe3 SHA256: 5e32da45e07fa8771316f1674cdb7775fd7e2d56298256623d3c67ed7534e019	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	2.28 KB (2338 bytes)	MD5: ba59d690511615ff5dba43b8dd5d9aa3 SHA1: d13e2219cefe5694c942550a0289234c6cc4808d SHA256: 1b50c8286f18aee27ac5337f51a60d028190f24cde5627776a0243ad62b8cfee	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	2.53 KB (2593 bytes)	MD5: e762c37b5807251f282414012fe2009b SHA1: 96d7afcc2128b4d7211a07c9fe6bf99afa547d90 SHA256: c815a1a5b7d59c631ed0c207ef53d4426deb77b7dfad9e28ca1a11b492ac5b04	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	2.78 KB (2851 bytes)	MD5: ea6441c70e9188d0ed6d0eb6a286a601 SHA1: 9df4f3cd002046976c2f493cabfdd239d565a687 SHA256: a1a80b8cbe0ae3ccb1de180eb7975983da6d7b1d8928318801a4e2a0fb67f347	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	3.02 KB (3089 bytes)	MD5: 030ff7962063f02d5896a8431c841a57 SHA1: c10b994f30d9714b92f5aaa4854d79883d030596 SHA256: 943de26e7c618724d702aedb30d5aba8057bea2697c5acbbb38876e3c2dc738e	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	3.27 KB (3344 bytes)	MD5: 98940ed2350b00d2ef6629dfb9f08c00 SHA1: ebc46c3cca6048a71ce9573676e368684f90478a SHA256: 65d061d505641ae4d3ee64bc8c6972a958c16db59bdcfbca096bd40f74eb70a9	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	3.52 KB (3602 bytes)	MD5: 357f32a54d5d517df86e981bd9019870 SHA1: c0d4ec432c0e3bdb31b6222583148acd077a135d SHA256: 7c6e9e56ce32afcab61799d28374b6c7f57972f1fae7819c751bcf3233c758d5	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	3.75 KB (3840 bytes)	MD5: 4142c9a690eb4e1d0b215a747f333546 SHA1: 3764fad05b6b3fa10d03cefc337f24a6ae424525 SHA256: 27f289761a908db346923240a85b20ed5e5f89b569b443ee9994f5d22df85624	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	4.00 KB (4095 bytes)	MD5: 3ff8ec0ba3fea26c14b27fe8ca267d44 SHA1: 91b2244d60ca5612c986312975f278da359eb2cc SHA256: b5c5e72c914d2624dc68d09a826acda5f0d84753d2e09fa0c76b7331a46b60f6	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	4.25 KB (4353 bytes)	MD5: e46d6766caf36eafeac7a3f827215fb3 SHA1: e1f3a7e548578540fdb9ea1db517f15a99a36ad7 SHA256: 2abc10027eca4fec37d699b0d8041c7f3be80933a82c3ff66ebfb54dc0c296d8	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	4.48 KB (4591 bytes)	MD5: 39c96c7e7dbc025832df850bfc74323b SHA1: 3c95a66fb5db650f50363bd8c0d0612d190b9ba0 SHA256: d57f2612bbb151f0bcd3f97dc99395d763f04649f3a4a8331bddd59c4816a13d	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	4.70 KB (4808 bytes)	MD5: aa7ed1b1d6502b7bdcb0b33985edc3f6 SHA1: 6fae494693abfbc112f9252f59aea3d2f3a8bfbe SHA256: 73590e55e6f6eaad180030898fd2f3e1c085b023931795cf8060fee8f09b8397	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	4.95 KB (5066 bytes)	MD5: 53b81458b9f35668bc97f234805c5796 SHA1: 943dd361b17f42fedea9d1e0eddc2e8ca255fa2a SHA256: f6232588fb72f18b5d28ac56bfdc4419178a46385d6ed0a047eb12ae8310858e	File Actions Show Properties Download
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	5.18 KB (5303 bytes)	MD5: 61d8c35dfdf0c7474057df1e12399328 SHA1: 0646ffed24eef4ec10b2e2033e7bf3411fa628a0 SHA256: 274307bf49ed0bccbaba90b17a059ce2fb3515dedeeffe840bc3d4ce700ea544	File Actions Show Properties Download

Host Behavior

File (54)

Operation	Filename	Additional Information	Count	Logfile
CREATE		desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	2	Fn
CREATE		desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	desired_access = FILE_READ_EA, file_attributes = FILE_ATTRIBUTE_NORMAL, create_disposition = FILE_OPEN, create_options = FILE_NON_DIRECTORY_FILE, ea_buffer = 0, ea_length = 0	1	Fn
CREATE	vmgenerationcounter	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	hgfs	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	vmci	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	vboxguest	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	vboxmouse	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	vboxvideo	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	vboxminirddn	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	vboxtrayipc	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	virtualmachineservices	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	prl_pv	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	prl_tg	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	prl_time	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\popupkiller.exe	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\stimulator.exe	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\tools\execute.exe	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	npf_ndiswanip	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	sice	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	siwvid	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	siwdebug	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	ntice	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	regvxg	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	filevxg	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	regsys	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	filem	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	trw	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	icext	share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_WRITE, GENERIC_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\desktop (create shortcut).igb	desired_access = GENERIC_WRITE, GENERIC_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\windows powershell (x86).ezu	desired_access = GENERIC_WRITE, GENERIC_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	desired_access = GENERIC_WRITE, GENERIC_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	desired_access = FILE_WRITE_EA, file_attributes = FILE_ATTRIBUTE_NORMAL, create_disposition = FILE_OPEN, create_options = FILE_NON_DIRECTORY_FILE, ea_buffer = 0, ea_length = 0	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE, create_disposition = OPEN_EXISTING, file_attributes = FILE_FLAG_BACKUP_SEMANTICS	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	desired_access = FILE_WRITE_ATTRIBUTES, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java	desired_access = FILE_WRITE_ATTRIBUTES, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = FILE_WRITE_ATTRIBUTES, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player	desired_access = FILE_WRITE_ATTRIBUTES, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	3	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\desktop (create shortcut).igb	desired_access = FILE_WRITE_ATTRIBUTES, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\windows powershell (x86).ezu	desired_access = FILE_WRITE_ATTRIBUTES, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
CREATE_DIR			2	Fn
READ	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	size = 124416	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	size = 124416	1	Fn Data
WRITE	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	size = 208	1	Fn Data

Process (9)

Operation	Process Name	Additional Information	Count	Logfile
CREATE	"C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming\Sun\Java\Devices.exe"	os_tid = 0xbcc, os_pid = 0x84, creation_flags = CREATE_DEFAULT_ERROR_MODE, current_directory = C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming, show_window = SW_HIDE	1	Fn
CREATE	"C:\Windows\system32\cmd.exe" \c "C:\Users\WI2YHM~1\AppData\Local\Temp\upd823d0e12.bat"	os_tid = 0xcb0, os_pid = 0xcac, creation_flags = CREATE_DEFAULT_ERROR_MODE, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_OPERATION, READ_CONTROL, desired_access = PROCESS_VM_OPERATION, READ_CONTROL	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATION	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_WRITE, desired_access = PROCESS_VM_WRITE	5	Fn

Module (29)

Operation	Module	Additional Information	Count	Logfile
LOAD	NTDLL	base_address = 0x773d0000	2	Fn
LOAD	advapi32.dll	base_address = 0x76d70000	1	Fn
LOAD	shlwapi.dll	base_address = 0x76ae0000	1	Fn
LOAD	shell32.dll	base_address = 0x747b0000	1	Fn
LOAD	ole32.dll	base_address = 0x76800000	1	Fn
LOAD	api-ms-win-core-com-l1-1-0	base_address = 0x77120000	1	Fn
LOAD	psapi.dll	base_address = 0x75f10000	1	Fn
LOAD	secur32.dll	base_address = 0x74350000	1	Fn
LOAD	SSPICLI	base_address = 0x744e0000	1	Fn
LOAD	SbieDll.dll	base_address = 0x0	1	Fn
GET_HANDLE	c:\windows\syswow64\kernel32.dll	base_address = 0x76460000	2	Fn
GET_HANDLE	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	base_address = 0x140000	1	Fn
GET_HANDLE	c:\windows\syswow64\ntdll.dll	base_address = 0x773d0000	1	Fn
GET_HANDLE	advapi32.dll	base_address = 0x0	1	Fn
GET_HANDLE	shlwapi.dll	base_address = 0x0	1	Fn
GET_HANDLE	shell32.dll	base_address = 0x0	1	Fn
GET_HANDLE	ole32.dll	base_address = 0x0	1	Fn
GET_HANDLE	psapi.dll	base_address = 0x0	1	Fn
GET_HANDLE	secur32.dll	base_address = 0x0	1	Fn
GET_HANDLE	c:\windows\syswow64\user32.dll	base_address = 0x75dd0000	1	Fn
GET_FILENAME	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	file_name = C:\Users\WI2yhmtI onvScY7Pe\Desktop\Tax Tool.exe, module_name = psapi.dll, os_pid = 0x990	1	Fn
GET_FILENAME	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	file_name = C:\Users\WI2yhmtI onvScY7Pe\Desktop\Tax Tool.exe, module_name = secur32.dll, os_pid = 0x990	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlAddVectoredExceptionHandler, address = 0x7742f090	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlInitializeCriticalSection, address = 0x774295f0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\combase.dll	function = CLSIDFromString, address = 0x771d1390	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\sspicli.dll	function = GetUserNameExW, address = 0x744ec5f0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = wine_get_unix_file_name, address = 0x0	1	Fn

Registry (69)

Operation	Key	Additional Information	Count	Logfile
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Narrator		2	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\WAB		4	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Feeds		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\WcmSvc		3	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech		3	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fax		3	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\GameBar		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Keyboard		3	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Wisp		2	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\FTP		4	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive		3	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows		3	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Unistore		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\UserData		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\PeerNet		4	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Pim		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Java VM		2	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Poom		2	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\MSF		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\SkyDrive		2	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\F12		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Osk		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Cuxiy		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Hayfra		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Ygizgo		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo		1	Fn
OPEN_KEY	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion		4	Fn
OPEN_KEY	HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools		1	Fn
OPEN_KEY	HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions		1	Fn
OPEN_KEY	HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__		1	Fn
OPEN_KEY	HKEY_LOCAL_MACHINE\HARDWARE\Description\System		1	Fn
OPEN_KEY	HKEY_CURRENT_USER\Software\WINE		1	Fn
OPEN_KEY	HKEY_LOCAL_MACHINE\Software\WINE		1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	value_name = InstallDate, data_ident_out = 0	2	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	value_name = DigitalProductId	2	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\HARDWARE\Description\System	value_name = SystemBiosVersion, data_ident_out = 0	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\HARDWARE\Description\System	value_name = SystemBiosVersion, data_ident_out = PTLTD - 6040000	1	Fn

User (10)

Operation	User/Group/Server	Additional Information	Success	Count	Logfile
LOOKUP_PRIVILEGE	Localhost	privilege = SeSecurityPrivilege		5	Fn
SET_PRIVILEGE	Localhost	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe, os_pid = 0x990, desired_access = PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeSecurityPrivilege		5	Fn

Keyboard (2)

Operation	Virtual Key Code	Additional Information	Success	Count	Logfile
GET_INFO	KB_LOCALE_ID			2	Fn

System (29)

Operation	Information	Success	Count	Logfile
SLEEP	duration = 0 milliseconds (0.000 seconds)		28	Fn
SLEEP	duration = -1 (infinite)		1	Fn

Mutex (10)

Operation	Name	Additional Information	Count	Logfile
CREATE	8A000000B7496798F6145935AA3E2760	initial_owner = 0	2	Fn
CREATE	MicrosoftVirtualPC7UserServiceMakeSureWe'reTheOnlyOneMutex	initial_owner = 0	1	Fn
CREATE	Sandboxie_SingleInstanceMutex_Control	initial_owner = 0	1	Fn
CREATE	Frz_State	initial_owner = 0	1	Fn
CREATE	4B000000D586D2D8AB6E07EC44CC9183	initial_owner = 0	1	Fn
OPEN	C0000000844EE6C40648470D345E7B65	desired_access = SYNCHRONIZE	1	Fn
RELEASE	8A000000B7496798F6145935AA3E2760		2	Fn
RELEASE	4B000000D586D2D8AB6E07EC44CC9183		1	Fn

Process #2: devices.exe

(Host: 83, Network: 0)

Information	Value
ID / OS PID	#2 / 0x84
OS Parent PID	0x990 (c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe)
Initial Working Directory	C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming
File Name	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe
Command Line	"C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming\Sun\Java\Devices.exe"
Monitor	Start Time: 00:00:57, Reason: Child Process
Unmonitor	End Time: 00:01:09, Reason: Terminated
Monitor Duration	00:00:12
OS Thread IDs	#3 0xBCC #4 0x8E4

Region

Name	Start VA	End VA	Type	Permissions	Actions
Devices.exe	0x00bd0000	0x00bf3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions Download
private_0x0000000000c40000	0x00c40000	0x00c5ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000c40000	0x00c40000	0x00c4ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000c50000	0x00c50000	0x00c53fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000c60000	0x00c60000	0x00c61fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000c60000	0x00c60000	0x00c60fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000c70000	0x00c70000	0x00c83fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000c90000	0x00c90000	0x00ccffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000cd0000	0x00cd0000	0x00dcffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000dd0000	0x00dd0000	0x00dd3fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000de0000	0x00de0000	0x00de1fff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x00df0000	0x00eadfff	Memory Mapped File	Readable	Region Actions
private_0x0000000000eb0000	0x00eb0000	0x00eeffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000ef0000	0x00ef0000	0x00ef0fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000f00000	0x00f00000	0x00f00fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000f60000	0x00f60000	0x00f6ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000001050000	0x01050000	0x0114ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000011f0000	0x011f0000	0x0127ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000001280000	0x01280000	0x0137ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000014c0000	0x014c0000	0x014cffff	Private Memory	Readable, Writable	Region Actions
SortDefault.nls	0x014d0000	0x01806fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000001810000	0x01810000	0x01997fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000019a0000	0x019a0000	0x01b20fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000001b30000	0x01b30000	0x02f2ffff	Pagefile Backed Memory	Readable	Region Actions
wow64win.dll	0x64da0000	0x64e12fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64.dll	0x64e20000	0x64e6efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64cpu.dll	0x64e70000	0x64e77fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x74320000	0x74347fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
secur32.dll	0x74350000	0x74359fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x74360000	0x7438efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcrypt.dll	0x74390000	0x743aafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x743b0000	0x743c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apphelp.dll	0x743d0000	0x74460fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcryptprimitives.dll	0x74470000	0x744c8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x744d0000	0x744d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x744e0000	0x744fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x745a0000	0x7465dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x74660000	0x747acfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x747b0000	0x75b6efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x75b70000	0x75c1bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x75dd0000	0x75f0ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x75f10000	0x75f15fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
windows.storage.dll	0x75f20000	0x763fcfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x76460000	0x7654ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x76800000	0x768e9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x769c0000	0x76adffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x76ae0000	0x76b23fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x76d70000	0x76deafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
SHCore.dll	0x76df0000	0x76e7cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel.appcore.dll	0x76e80000	0x76e8bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x76e90000	0x76ed2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
KernelBase.dll	0x76fa0000	0x77115fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
combase.dll	0x77120000	0x772d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x77340000	0x7734efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x77350000	0x7737afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
powrprof.dll	0x77380000	0x773c3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x773d0000	0x77548fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000000007e3f0000	0x7e3f0000	0x7e4effff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x000000007e4f0000	0x7e4f0000	0x7e512fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007e513000	0x7e513000	0x7e513fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e518000	0x7e518000	0x7e518fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e51a000	0x7e51a000	0x7e51cfff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e51d000	0x7e51d000	0x7e51ffff	Private Memory	Readable, Writable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
private_0x000000007fff0000	0x7fff0000	0x7ffd2ef5ffff	Private Memory	Readable	Region Actions
ntdll.dll	0x7ffd2ef60000	0x7ffd2f121fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x00007ffd2f122000	0x7ffd2f122000	0x7ffffffeffff	Private Memory	Readable	Region Actions

Host Behavior

File (11)

Operation	Filename	Additional Information	Count	Logfile
CREATE		desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
CREATE		desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	desired_access = FILE_READ_EA, file_attributes = FILE_ATTRIBUTE_NORMAL, create_disposition = FILE_OPEN, create_options = FILE_NON_DIRECTORY_FILE, ea_buffer = 0, ea_length = 0	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	2	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
CREATE_DIR			1	Fn
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 265	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 265	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 529	1	Fn Data

Process (9)

Operation	Process Name	Additional Information	Count	Logfile
CREATE	C:\Windows\SysWOW64\svchost.exe -k netsvcs	os_tid = 0x540, os_pid = 0x2ec, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE	1	Fn
CREATE	C:\Windows\SysWOW64\svchost.exe -k netsvcs	os_tid = 0xc58, os_pid = 0xc54, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_OPERATION, READ_CONTROL, desired_access = PROCESS_VM_OPERATION, READ_CONTROL	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATION	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_WRITE, desired_access = PROCESS_VM_WRITE	5	Fn

Memory (10)

Operation	Address	Additional Information	Count	Logfile
ALLOC	0x4eb0000	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0x2ec, size = 147456, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE	1	Fn
ALLOC	0x5b0000	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0xc54, size = 147456, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE	1	Fn
WRITE	0x4eb0000	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0x2ec, size = 147456	1	Fn Data
WRITE	0x4ece724	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0x2ec, size = 4	1	Fn Data
WRITE	0x4ece840	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0x2ec, size = 4	1	Fn Data
WRITE	0x4ecee38	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0x2ec, size = 4	1	Fn Data
WRITE	0x5b0000	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0xc54, size = 147456	1	Fn Data
WRITE	0x5ce724	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0xc54, size = 4	1	Fn Data
WRITE	0x5ce840	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0xc54, size = 4	1	Fn Data
WRITE	0x5cee38	process_name = C:\Windows\SysWOW64\svchost.exe -k netsvcs, os_pid = 0xc54, size = 4	1	Fn Data

Thread (2)

Operation	Process Name	Additional Information	Success	Count	Logfile
CREATE	C:\Windows\SysWOW64\svchost.exe -k netsvcs	os_pid = 0x2ec, proc_address = 0x4ebc978, flags = THREAD_RUNS_IMMEDIATELY		1	Fn
CREATE	C:\Windows\SysWOW64\svchost.exe -k netsvcs	os_pid = 0xc54, proc_address = 0x5bc978, flags = THREAD_RUNS_IMMEDIATELY		1	Fn

Module (24)

Operation	Module	Additional Information	Count	Logfile
LOAD	NTDLL	base_address = 0x773d0000	2	Fn
LOAD	advapi32.dll	base_address = 0x76d70000	1	Fn
LOAD	shlwapi.dll	base_address = 0x76ae0000	1	Fn
LOAD	shell32.dll	base_address = 0x747b0000	1	Fn
LOAD	ole32.dll	base_address = 0x76800000	1	Fn
LOAD	api-ms-win-core-com-l1-1-0	base_address = 0x77120000	1	Fn
LOAD	psapi.dll	base_address = 0x75f10000	1	Fn
LOAD	secur32.dll	base_address = 0x74350000	1	Fn
LOAD	SSPICLI	base_address = 0x744e0000	1	Fn
GET_HANDLE	c:\windows\syswow64\kernel32.dll	base_address = 0x76460000	1	Fn
GET_HANDLE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	base_address = 0xbd0000	1	Fn
GET_HANDLE	c:\windows\syswow64\ntdll.dll	base_address = 0x773d0000	1	Fn
GET_HANDLE	advapi32.dll	base_address = 0x0	1	Fn
GET_HANDLE	shlwapi.dll	base_address = 0x0	1	Fn
GET_HANDLE	shell32.dll	base_address = 0x0	1	Fn
GET_HANDLE	ole32.dll	base_address = 0x0	1	Fn
GET_HANDLE	psapi.dll	base_address = 0x0	1	Fn
GET_HANDLE	secur32.dll	base_address = 0x0	1	Fn
GET_FILENAME	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	file_name = C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming\Sun\Java\Devices.exe, module_name = psapi.dll, os_pid = 0x990	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlAddVectoredExceptionHandler, address = 0x7742f090	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlInitializeCriticalSection, address = 0x774295f0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\combase.dll	function = CLSIDFromString, address = 0x771d1390	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\sspicli.dll	function = GetUserNameExW, address = 0x744ec5f0	1	Fn

Registry (4)

Operation	Key	Additional Information	Count	Logfile
OPEN_KEY	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion		2	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	value_name = InstallDate, data_ident_out = 0	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	value_name = DigitalProductId	1	Fn

User (10)

Operation	User/Group/Server	Additional Information	Success	Count	Logfile
LOOKUP_PRIVILEGE	Localhost	privilege = SeSecurityPrivilege		5	Fn
SET_PRIVILEGE	Localhost	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe, os_pid = 0x990, desired_access = PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeSecurityPrivilege		5	Fn

Mutex (13)

Operation	Name	Additional Information	Count	Logfile
CREATE	8A000000B7496798F6145935AA3E2760	initial_owner = 0	3	Fn
CREATE	9C0000002CCF1F00ECD770C403E9DE7B	initial_owner = 1	1	Fn
CREATE	54000000F61A7DE2C294AD9653CFD4FD	initial_owner = 1	1	Fn
CREATE	AD0000002B4477546D3A308A977C30F1	initial_owner = 1	1	Fn
OPEN	D20000002A14C6E52964F51932B9F49F	desired_access = SYNCHRONIZE	2	Fn
OPEN	A1000000DA6AF38235D35BF570C2C4E9	desired_access = SYNCHRONIZE	2	Fn
RELEASE	8A000000B7496798F6145935AA3E2760		3	Fn

Process #3: svchost.exe

(Host: 1960, Network: 0)

Information	Value
ID / OS PID	#3 / 0x2ec
OS Parent PID	0x84 (c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe)
Initial Working Directory	C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming
File Name	c:\windows\syswow64\svchost.exe
Command Line	C:\Windows\SysWOW64\svchost.exe -k netsvcs
Monitor	Start Time: 00:00:58, Reason: Child Process
Unmonitor	End Time: 00:02:38, Reason: Terminated by Timeout
Monitor Duration	00:01:40
OS Thread IDs	#5 0x540 #6 0x7E4 #7 0x24C #17 0xD4C #18 0xD50 #21 0xD6C #22 0xD70 #23 0xD74 #24 0xD78 #25 0xD7C #26 0xD80 #27 0xD84 #28 0xD88 #34 0xDA0 #35 0xDA4 #36 0xDAC

Region

Name	Start VA	End VA	Type	Permissions	Actions
svchost.exe	0x00900000	0x0090afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x0000000000db0000	0x00db0000	0x04daffff	Pagefile Backed Memory	-	Region Actions
private_0x0000000004db0000	0x04db0000	0x04dcffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000004db0000	0x04db0000	0x04dbffff	Pagefile Backed Memory	Readable, Writable	Region Actions
svchost.exe.mui	0x04dc0000	0x04dc0fff	Memory Mapped File	Readable	Region Actions
private_0x0000000004dd0000	0x04dd0000	0x04dd0fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004dd0000	0x04dd0000	0x04dd0fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000004de0000	0x04de0000	0x04df3fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000004e00000	0x04e00000	0x04e3ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004e40000	0x04e40000	0x04e7ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000004e80000	0x04e80000	0x04e83fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000004e90000	0x04e90000	0x04e90fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000004ea0000	0x04ea0000	0x04ea1fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004eb0000	0x04eb0000	0x04ed3fff	Private Memory	Readable, Writable, Executable	Region Actions
private_0x0000000004ee0000	0x04ee0000	0x04f1ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004ee0000	0x04ee0000	0x04efefff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004ee0000	0x04ee0000	0x04f1ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004f20000	0x04f20000	0x04f5ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004f20000	0x04f20000	0x04f5ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004f60000	0x04f60000	0x04f9ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004fa0000	0x04fa0000	0x04fdffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004fe0000	0x04fe0000	0x04fe0fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004ff0000	0x04ff0000	0x04ff0fff	Private Memory	Readable, Writable, Executable	Region Actions
private_0x0000000005000000	0x05000000	0x05003fff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x05010000	0x050cdfff	Memory Mapped File	Readable	Region Actions
private_0x00000000050d0000	0x050d0000	0x050e2fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000050d0000	0x050d0000	0x050d0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
counters.dat	0x050e0000	0x050e0fff	Memory Mapped File	Readable, Writable	Region Actions Download
private_0x00000000050f0000	0x050f0000	0x050f6fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005100000	0x05100000	0x051fffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005200000	0x05200000	0x052fffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005300000	0x05300000	0x0533ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005340000	0x05340000	0x05340fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005340000	0x05340000	0x05352fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000005340000	0x05340000	0x0534ffff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000005350000	0x05350000	0x05350fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000005360000	0x05360000	0x05363fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005370000	0x05370000	0x053affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000053b0000	0x053b0000	0x053effff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000053f0000	0x053f0000	0x053f1fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000005400000	0x05400000	0x054fffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005500000	0x05500000	0x0553ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005540000	0x05540000	0x0557ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005580000	0x05580000	0x055bffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000055c0000	0x055c0000	0x055c4fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000055d0000	0x055d0000	0x055e2fff	Private Memory	Readable, Writable	Region Actions
mswsock.dll.mui	0x055d0000	0x055d2fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000055e0000	0x055e0000	0x055e1fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000055f0000	0x055f0000	0x055f0fff	Private Memory	Readable, Writable	Region Actions
crypt32.dll.mui	0x055f0000	0x055f9fff	Memory Mapped File	Readable	Region Actions
private_0x0000000005600000	0x05600000	0x057cffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005600000	0x05600000	0x056fffff	Private Memory	Readable, Writable	Region Actions
SortDefault.nls	0x05700000	0x05a36fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000005a40000	0x05a40000	0x05bc7fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000005bd0000	0x05bd0000	0x05d50fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000005d60000	0x05d60000	0x0715ffff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000007160000	0x07160000	0x0725ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007260000	0x07260000	0x0735ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007360000	0x07360000	0x0745ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007460000	0x07460000	0x0755ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007560000	0x07560000	0x0759ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000075a0000	0x075a0000	0x0769ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000076a0000	0x076a0000	0x076dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000076e0000	0x076e0000	0x077dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000077e0000	0x077e0000	0x077f2fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000077e0000	0x077e0000	0x0781ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007820000	0x07820000	0x0785ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007860000	0x07860000	0x0789ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007860000	0x07860000	0x07872fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007860000	0x07860000	0x07872fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007860000	0x07860000	0x07870fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000078a0000	0x078a0000	0x078dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000078e0000	0x078e0000	0x078f2fff	Private Memory	Readable, Writable	Region Actions
winnlsres.dll	0x078e0000	0x078e4fff	Memory Mapped File	Readable	Region Actions
winnlsres.dll.mui	0x078f0000	0x078fffff	Memory Mapped File	Readable	Region Actions
private_0x0000000007900000	0x07900000	0x0793ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007940000	0x07940000	0x0797ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000079a0000	0x079a0000	0x079a4fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007a00000	0x07a00000	0x07baffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007a00000	0x07a00000	0x07afffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007b00000	0x07b00000	0x07bfffff	Private Memory	Readable, Writable	Region Actions
wow64win.dll	0x64da0000	0x64e12fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64.dll	0x64e20000	0x64e6efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64cpu.dll	0x64e70000	0x64e77fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ncryptsslp.dll	0x73660000	0x73679fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cabinet.dll	0x73680000	0x736a1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
webio.dll	0x736b0000	0x73717fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dhcpcsvc.dll	0x73720000	0x73733fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dhcpcsvc6.dll	0x73740000	0x73752fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptnet.dll	0x73760000	0x73785fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gpapi.dll	0x73790000	0x737aefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dpapi.dll	0x737b0000	0x737b7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntasn1.dll	0x737c0000	0x737e7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ncrypt.dll	0x737f0000	0x7380ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mskeyprotect.dll	0x73810000	0x7381ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
schannel.dll	0x73820000	0x7387ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
comctl32.dll	0x73880000	0x73a88fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
FWPUCLNT.DLL	0x73a90000	0x73ad5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasadhlp.dll	0x73ae0000	0x73ae7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dnsapi.dll	0x73af0000	0x73b73fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mswsock.dll	0x73b80000	0x73bcdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winhttp.dll	0x73bd0000	0x73c76fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winnsi.dll	0x73c80000	0x73c87fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
IPHLPAPI.DLL	0x73c90000	0x73cbffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
urlmon.dll	0x73cc0000	0x73e1ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iertutil.dll	0x73e20000	0x740e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wininet.dll	0x740f0000	0x74313fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x74320000	0x74347fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
secur32.dll	0x74350000	0x74359fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x74360000	0x7438efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcrypt.dll	0x74390000	0x743aafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x743b0000	0x743c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
OnDemandConnRouteHelper.dll	0x743d0000	0x743e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
uxtheme.dll	0x743f0000	0x74464fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcryptprimitives.dll	0x74470000	0x744c8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x744d0000	0x744d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x744e0000	0x744fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x745a0000	0x7465dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x74660000	0x747acfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x747b0000	0x75b6efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x75b70000	0x75c1bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x75dd0000	0x75f0ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x75f10000	0x75f15fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
windows.storage.dll	0x75f20000	0x763fcfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
Wldap32.dll	0x76400000	0x76452fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x76460000	0x7654ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x76550000	0x765e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
crypt32.dll	0x765f0000	0x76764fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msasn1.dll	0x768f0000	0x768fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wintrust.dll	0x76900000	0x76941fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nsi.dll	0x76950000	0x76956fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ws2_32.dll	0x76960000	0x769bbfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x769c0000	0x76adffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x76ae0000	0x76b23fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x76d70000	0x76deafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
SHCore.dll	0x76df0000	0x76e7cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel.appcore.dll	0x76e80000	0x76e8bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel.appcore.dll	0x76e80000	0x76e8bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x76e90000	0x76ed2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
KernelBase.dll	0x76fa0000	0x77115fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
combase.dll	0x77120000	0x772d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x77340000	0x7734efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x77350000	0x7737afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
powrprof.dll	0x77380000	0x773c3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x773d0000	0x77548fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007e7c2000	0x7e7c2000	0x7e7c4fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7c5000	0x7e7c5000	0x7e7c7fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7c8000	0x7e7c8000	0x7e7cafff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7cb000	0x7e7cb000	0x7e7cdfff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7ce000	0x7e7ce000	0x7e7d0fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7d1000	0x7e7d1000	0x7e7d3fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7d4000	0x7e7d4000	0x7e7d6fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7d7000	0x7e7d7000	0x7e7d9fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7da000	0x7e7da000	0x7e7dcfff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e7dd000	0x7e7dd000	0x7e7dffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x000000007e7e0000	0x7e7e0000	0x7e8dffff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x000000007e8e0000	0x7e8e0000	0x7e902fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007e903000	0x7e903000	0x7e905fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e906000	0x7e906000	0x7e908fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e906000	0x7e906000	0x7e908fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e909000	0x7e909000	0x7e909fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e90b000	0x7e90b000	0x7e90dfff	Private Memory	Readable, Writable	Region Actions
private_0x000000007e90e000	0x7e90e000	0x7e90efff	Private Memory	Readable, Writable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
private_0x000000007fff0000	0x7fff0000	0x7dfd2ef5ffff	Private Memory	Readable	Region Actions
pagefile_0x00007dfd2ef60000	0x7dfd2ef60000	0x7ffd2ef5ffff	Pagefile Backed Memory	-	Region Actions
ntdll.dll	0x7ffd2ef60000	0x7ffd2f121fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x00007ffd2f122000	0x7ffd2f122000	0x7ffffffeffff	Private Memory	Readable	Region Actions

Injection Information

Injection Type	Source Process	Source Os Thread ID	Injection Info	Count	Logfile
Modify Memory	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x4eb0000, size = 147456	1	Fn Data
Modify Memory	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x4ece724, size = 4	1	Fn Data
Modify Memory	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x4ece840, size = 4	1	Fn Data
Modify Memory	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x4ecee38, size = 4	1	Fn Data
Create Remote Thread	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x4ebc978, flags = THREAD_RUNS_IMMEDIATELY	1	Fn

Created Files

Filename	File Size	Hash Values	YARA Match	Actions
c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.tmp	3.66 KB (3743 bytes)	MD5: 7a245ac97a224505665b541cbaeebee3 SHA1: fb77de1a8006c5cc48493e21778c03e9b7e190d0 SHA256: 62cd74f35b09b3aeba6cecef7202838b2f064346ae2497e7726c3f419acb2495		File Actions Show Properties Download

Host Behavior

File (133)

Operation	Filename	Additional Information	Count	Logfile
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	28	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	29	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\desktop (create shortcut).igb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	14	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
MOVE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.tmp	source_file_name = c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	1	Fn
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 529	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1103	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2193	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2451	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2709	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2967	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3225	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3485	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	size = 124416	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 300	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 558	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 782	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1040	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1294	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1584	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1842	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2080	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2338	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2593	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2851	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3089	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3344	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3602	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3840	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 4095	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 4353	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 4591	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 4808	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 5066	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1103	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1361	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2451	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2709	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2967	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3225	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3485	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3743	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 300	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 558	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 782	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1040	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1294	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1584	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1842	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2080	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2338	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2593	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2851	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3089	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3344	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3602	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 3840	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 4095	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 4353	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 4591	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 4808	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 5066	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 5303	1	Fn Data

Process (1429)

Operation	Process Name	Additional Information	Count	Logfile
OPEN	System Idle Process	os_pid = 0x0, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	System	os_pid = 0x4, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\smss.exe	os_pid = 0x108, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\csrss.exe	os_pid = 0x150, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\wininit.exe	os_pid = 0x18c, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\csrss.exe	os_pid = 0x194, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\winlogon.exe	os_pid = 0x1c4, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\services.exe	os_pid = 0x1dc, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\lsass.exe	os_pid = 0x1e4, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x23c, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x25c, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\dwm.exe	os_pid = 0x2e4, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x320, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x334, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x354, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x368, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x390, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x274, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\spoolsv.exe	os_pid = 0x230, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x41c, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x550, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\sihost.exe	os_pid = 0x700, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\taskhostw.exe	os_pid = 0x728, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\explorer.exe	os_pid = 0x7cc, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\runtimebroker.exe	os_pid = 0x4b0, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe	os_pid = 0x910, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe	os_pid = 0xa10, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\svchost.exe	os_pid = 0x590, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\wbem\wmiadap.exe	os_pid = 0xb34, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\sppsvc.exe	os_pid = 0x6ac, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\backgroundtaskhost.exe	os_pid = 0x414, desired_access = PROCESS_QUERY_INFORMATION	12	Fn
OPEN	c:\windows\system32\backgroundtaskhost.exe	os_pid = 0xba8, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\wbem\wmiprvse.exe	os_pid = 0xfc, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\system32\audiodg.exe	os_pid = 0x3f8, desired_access = PROCESS_QUERY_INFORMATION	37	Fn
OPEN	c:\windows\syswow64\svchost.exe	os_pid = 0xc54, desired_access = PROCESS_QUERY_INFORMATION	74	Fn
OPEN	c:\windows\system32\backgroundtaskhost.exe	os_pid = 0xdc0, desired_access = PROCESS_QUERY_INFORMATION	25	Fn
OPEN	c:\program files\windows defender\mpcmdrun.exe	os_pid = 0xde0, desired_access = PROCESS_QUERY_INFORMATION	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_OPERATION, READ_CONTROL, desired_access = PROCESS_VM_OPERATION, READ_CONTROL	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATION	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_WRITE, desired_access = PROCESS_VM_WRITE	57	Fn
OPEN_TOKEN	c:\windows\syswow64\svchost.exe	os_pid = 0xc54, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATION	37	Fn

Module (42)

Operation	Module	Additional Information	Count	Logfile
LOAD	KERNEL32.dll	base_address = 0x76460000	1	Fn
LOAD	NTDLL	base_address = 0x773d0000	4	Fn
LOAD	advapi32.dll	base_address = 0x76d70000	1	Fn
LOAD	shlwapi.dll	base_address = 0x76ae0000	1	Fn
LOAD	psapi.dll	base_address = 0x75f10000	1	Fn
LOAD	wininet.dll	base_address = 0x740f0000	1	Fn
LOAD	secur32.dll	base_address = 0x74350000	1	Fn
LOAD	SSPICLI	base_address = 0x744e0000	1	Fn
LOAD	crypt32.dll	base_address = 0x765f0000	1	Fn
LOAD	urlmon.dll	base_address = 0x73cc0000	1	Fn
GET_HANDLE	c:\windows\syswow64\ntdll.dll	base_address = 0x773d0000	1	Fn
GET_HANDLE	advapi32.dll	base_address = 0x0	1	Fn
GET_HANDLE	shlwapi.dll	base_address = 0x0	1	Fn
GET_HANDLE	psapi.dll	base_address = 0x0	1	Fn
GET_HANDLE	c:\windows\syswow64\user32.dll	base_address = 0x75dd0000	1	Fn
GET_HANDLE	wininet.dll	base_address = 0x0	1	Fn
GET_HANDLE	secur32.dll	base_address = 0x0	1	Fn
GET_HANDLE	crypt32.dll	base_address = 0x0	1	Fn
GET_HANDLE	urlmon.dll	base_address = 0x0	1	Fn
GET_FILENAME	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	file_name = C:\Windows\SysWOW64\svchost.exe, module_name = psapi.dll, os_pid = 0x990	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = InterlockedIncrement, address = 0x76477520	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapFree, address = 0x764725e0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address = 0x76477910	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapDestroy, address = 0x7647d940	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapCreate, address = 0x76479950	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = InterlockedExchange, address = 0x76477650	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address = 0x7740da90	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address = 0x76477940	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = LoadLibraryA, address = 0x7647d8d0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleA, address = 0x76479640	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = GetLastError, address = 0x76472db0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = InterlockedDecrement, address = 0x76477560	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = Sleep, address = 0x764777b0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address = 0x7740bae0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlAddVectoredExceptionHandler, address = 0x7742f090	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlInitializeCriticalSection, address = 0x774295f0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\sspicli.dll	function = GetUserNameExW, address = 0x744ec5f0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlEnterCriticalSection, address = 0x77415e80	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlLeaveCriticalSection, address = 0x77415e00	1	Fn

Registry (58)

Operation	Key	Additional Information	Count	Logfile
CREATE_KEY	HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run		1	Fn
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo		1	Fn
OPEN_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo		22	Fn
OPEN_KEY	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion		2	Fn
READ_VALUE	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo	value_name = Onpiwaad	14	Fn
READ_VALUE	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo	value_name = Vipoug	2	Fn
READ_VALUE	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo	value_name = Vipoug	12	Fn Data
READ_VALUE	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	value_name = InstallDate, data_ident_out = 0	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	value_name = DigitalProductId	1	Fn
WRITE_VALUE	HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run	value_name = Devices.exe, data = "C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming\Sun\Java\Devices.exe"	1	Fn
WRITE_VALUE	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo	value_name = Vipoug	1	Fn Data

User (114)

Operation	User/Group/Server	Additional Information	Success	Count	Logfile
LOOKUP_PRIVILEGE	Localhost	privilege = SeSecurityPrivilege		57	Fn
SET_PRIVILEGE	Localhost	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe, os_pid = 0x990, desired_access = PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeSecurityPrivilege		57	Fn

System (115)

Operation	Information	Count	Logfile
SLEEP	duration = -1 (infinite)	39	Fn
SLEEP	duration = 60000 milliseconds (60.000 seconds)	1	Fn
SLEEP	duration = -1 (infinite)	1	Fn
GET_INFO	type = SYSTEM_PROCESS_INFORMATION	37	Fn
GET_INFO	type = SYSTEM_PROCESS_INFORMATION	37	Fn

Mutex (69)

Operation	Name	Additional Information	Count	Logfile
CREATE	D20000002A14C6E52964F51932B9F49F	initial_owner = 1	1	Fn
CREATE	8A000000B7496798F6145935AA3E2760	initial_owner = 0	30	Fn
CREATE	D9000000F219E1C779E2E7AC08DFD815	initial_owner = 0	1	Fn
CREATE	7D0000008AA73D983C6DEAFF4C3848A7	initial_owner = 0	1	Fn
CREATE	3B000000F5DFE9C2D11C32931F7D5BB4	initial_owner = 0	1	Fn
CREATE	C0000000844EE6C40648470D345E7B65	initial_owner = 0	1	Fn
CREATE	4A000000AF17366BF4960AE62A76878C	initial_owner = 0	1	Fn
CREATE	D5000000C70E48D5408251026F4BDA97	initial_owner = 0	1	Fn
OPEN	4B000000D586D2D8AB6E07EC44CC9183	desired_access = SYNCHRONIZE	1	Fn
RELEASE	8A000000B7496798F6145935AA3E2760		30	Fn
RELEASE	D5000000C70E48D5408251026F4BDA97		1	Fn

Process #4: svchost.exe

(Host: 82, Network: 0)

Information	Value
ID / OS PID	#4 / 0xc54
OS Parent PID	0x84 (c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe)
Initial Working Directory	C:\Users\WI2yhmtI onvScY7Pe\AppData\Roaming
File Name	c:\windows\syswow64\svchost.exe
Command Line	C:\Windows\SysWOW64\svchost.exe -k netsvcs
Monitor	Start Time: 00:01:04, Reason: Child Process
Unmonitor	End Time: 00:02:38, Reason: Terminated by Timeout
Monitor Duration	00:01:34
OS Thread IDs	#8 0xC58 #9 0xC5C #10 0xC64 #19 0xD54 #20 0xD58 #29 0xD8C #30 0xD90 #31 0xD94 #32 0xD98 #33 0xD9C

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x00000000004b0000	0x004b0000	0x004cffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000004b0000	0x004b0000	0x004bffff	Pagefile Backed Memory	Readable, Writable	Region Actions
svchost.exe.mui	0x004c0000	0x004c0fff	Memory Mapped File	Readable	Region Actions
private_0x00000000004d0000	0x004d0000	0x004d0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000004d0000	0x004d0000	0x004d0fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000004e0000	0x004e0000	0x004f3fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000500000	0x00500000	0x0053ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000540000	0x00540000	0x0057ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000580000	0x00580000	0x00583fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000590000	0x00590000	0x00590fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000005a0000	0x005a0000	0x005a1fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000005b0000	0x005b0000	0x005d3fff	Private Memory	Readable, Writable, Executable	Region Actions
private_0x00000000005e0000	0x005e0000	0x0061ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000620000	0x00620000	0x0065ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000660000	0x00660000	0x0069ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000006a0000	0x006a0000	0x006a0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000006b0000	0x006b0000	0x006b6fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000006c0000	0x006c0000	0x006fffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000700000	0x00700000	0x007fffff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x00800000	0x008bdfff	Memory Mapped File	Readable	Region Actions
private_0x00000000008c0000	0x008c0000	0x008c0fff	Private Memory	Readable, Writable, Executable	Region Actions
svchost.exe	0x00900000	0x0090afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x0000000000910000	0x00910000	0x0490ffff	Pagefile Backed Memory	-	Region Actions
private_0x0000000004a10000	0x04a10000	0x04a13fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004ae0000	0x04ae0000	0x04ae3fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004b00000	0x04b00000	0x04bfffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004c00000	0x04c00000	0x04cfffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004e10000	0x04e10000	0x04e14fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004f00000	0x04f00000	0x0501ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004f00000	0x04f00000	0x04ffffff	Private Memory	Readable, Writable	Region Actions
SortDefault.nls	0x05000000	0x05336fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000005340000	0x05340000	0x054c7fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000054d0000	0x054d0000	0x05650fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000005660000	0x05660000	0x06a5ffff	Pagefile Backed Memory	Readable	Region Actions
wow64win.dll	0x64da0000	0x64e12fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64.dll	0x64e20000	0x64e6efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64cpu.dll	0x64e70000	0x64e77fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wininet.dll	0x740f0000	0x74313fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x74320000	0x74347fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
secur32.dll	0x74350000	0x74359fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x74360000	0x7438efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcrypt.dll	0x74390000	0x743aafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x743b0000	0x743c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcryptprimitives.dll	0x74470000	0x744c8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x744d0000	0x744d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x744e0000	0x744fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x745a0000	0x7465dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x74660000	0x747acfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x75b70000	0x75c1bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x75dd0000	0x75f0ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x75f10000	0x75f15fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x76460000	0x7654ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x769c0000	0x76adffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x76ae0000	0x76b23fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x76d70000	0x76deafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x76e90000	0x76ed2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
KernelBase.dll	0x76fa0000	0x77115fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
combase.dll	0x77120000	0x772d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x77350000	0x7737afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x773d0000	0x77548fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000000007f370000	0x7f370000	0x7f46ffff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x000000007f470000	0x7f470000	0x7f492fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f494000	0x7f494000	0x7f496fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007f497000	0x7f497000	0x7f499fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007f49a000	0x7f49a000	0x7f49afff	Private Memory	Readable, Writable	Region Actions
private_0x000000007f49c000	0x7f49c000	0x7f49efff	Private Memory	Readable, Writable	Region Actions
private_0x000000007f49f000	0x7f49f000	0x7f49ffff	Private Memory	Readable, Writable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
private_0x000000007fff0000	0x7fff0000	0x7dfd2ef5ffff	Private Memory	Readable	Region Actions
pagefile_0x00007dfd2ef60000	0x7dfd2ef60000	0x7ffd2ef5ffff	Pagefile Backed Memory	-	Region Actions
ntdll.dll	0x7ffd2ef60000	0x7ffd2f121fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x00007ffd2f122000	0x7ffd2f122000	0x7ffffffeffff	Private Memory	Readable	Region Actions

Injection Information

Injection Type	Source Process	Source Os Thread ID	Injection Info	Count	Logfile
Modify Memory	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x5b0000, size = 147456	1	Fn Data
Modify Memory	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x5ce724, size = 4	1	Fn Data
Modify Memory	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x5ce840, size = 4	1	Fn Data
Modify Memory	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x5cee38, size = 4	1	Fn Data
Create Remote Thread	c:\users\wi2yhmti onvscy7pe\appdata\roaming\sun\java\devices.exe	0xbcc	address = 0x5bc978, flags = THREAD_RUNS_IMMEDIATELY	1	Fn

Host Behavior

File (9)

Operation	Filename	Additional Information	Count	Logfile
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	2	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
CREATE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\desktop (create shortcut).igb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING	1	Fn
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1361	1	Fn Data
READ	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1935	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 1935	1	Fn Data
WRITE	c:\users\wi2yhmti onvscy7pe\appdata\roaming\adobe\flash player\1e45a456cb803f4096a6a7598c65e692_8c74eee4-8873-4eb3-9315-336075ff5033.hoe	size = 2193	1	Fn Data

Process (6)

Operation	Process Name	Additional Information	Count	Logfile
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_OPERATION, READ_CONTROL, desired_access = PROCESS_VM_OPERATION, READ_CONTROL	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATION	1	Fn
OPEN_TOKEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	os_pid = 0x990, desired_access = PROCESS_VM_WRITE, desired_access = PROCESS_VM_WRITE	4	Fn

Module (34)

Operation	Module	Additional Information	Count	Logfile
LOAD	KERNEL32.dll	base_address = 0x76460000	1	Fn
LOAD	NTDLL	base_address = 0x773d0000	2	Fn
LOAD	advapi32.dll	base_address = 0x76d70000	1	Fn
LOAD	shlwapi.dll	base_address = 0x76ae0000	1	Fn
LOAD	psapi.dll	base_address = 0x75f10000	1	Fn
LOAD	wininet.dll	base_address = 0x740f0000	1	Fn
LOAD	secur32.dll	base_address = 0x74350000	1	Fn
LOAD	SSPICLI	base_address = 0x744e0000	1	Fn
GET_HANDLE	c:\windows\syswow64\ntdll.dll	base_address = 0x773d0000	1	Fn
GET_HANDLE	advapi32.dll	base_address = 0x0	1	Fn
GET_HANDLE	shlwapi.dll	base_address = 0x0	1	Fn
GET_HANDLE	psapi.dll	base_address = 0x0	1	Fn
GET_HANDLE	c:\windows\syswow64\user32.dll	base_address = 0x75dd0000	1	Fn
GET_HANDLE	wininet.dll	base_address = 0x0	1	Fn
GET_HANDLE	secur32.dll	base_address = 0x0	1	Fn
GET_FILENAME	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	file_name = C:\Windows\SysWOW64\svchost.exe, module_name = psapi.dll, os_pid = 0x990	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = InterlockedIncrement, address = 0x76477520	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapFree, address = 0x764725e0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address = 0x76477910	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapDestroy, address = 0x7647d940	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapCreate, address = 0x76479950	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = InterlockedExchange, address = 0x76477650	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address = 0x7740da90	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address = 0x76477940	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = LoadLibraryA, address = 0x7647d8d0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleA, address = 0x76479640	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = GetLastError, address = 0x76472db0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = InterlockedDecrement, address = 0x76477560	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = Sleep, address = 0x764777b0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address = 0x7740bae0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlAddVectoredExceptionHandler, address = 0x7742f090	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\ntdll.dll	function = RtlInitializeCriticalSection, address = 0x774295f0	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\sspicli.dll	function = GetUserNameExW, address = 0x744ec5f0	1	Fn

Registry (13)

Operation	Key	Additional Information	Count	Logfile
CREATE_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo		1	Fn
OPEN_KEY	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo		4	Fn
READ_VALUE	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo	value_name = Onpiwaad	1	Fn
READ_VALUE	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo	value_name = Vipoug	6	Fn Data
WRITE_VALUE	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fabo	value_name = Vipoug	1	Fn Data

User (8)

Operation	User/Group/Server	Additional Information	Success	Count	Logfile
LOOKUP_PRIVILEGE	Localhost	privilege = SeSecurityPrivilege		4	Fn
SET_PRIVILEGE	Localhost	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe, os_pid = 0x990, desired_access = PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeSecurityPrivilege		4	Fn

System (2)

Operation	Information	Success	Count	Logfile
SLEEP	duration = -1 (infinite)		2	Fn

Mutex (10)

Operation	Name	Additional Information	Count	Logfile
CREATE	A1000000DA6AF38235D35BF570C2C4E9	initial_owner = 1	1	Fn
CREATE	8A000000B7496798F6145935AA3E2760	initial_owner = 0	2	Fn
CREATE	D5000000C70E48D5408251026F4BDA97	initial_owner = 0	1	Fn
CREATE	C0000000844EE6C40648470D345E7B65	initial_owner = 0	1	Fn
CREATE	4A000000AF17366BF4960AE62A76878C	initial_owner = 0	1	Fn
OPEN	4B000000D586D2D8AB6E07EC44CC9183	desired_access = SYNCHRONIZE	1	Fn
RELEASE	8A000000B7496798F6145935AA3E2760		2	Fn
RELEASE	D5000000C70E48D5408251026F4BDA97		1	Fn

Process #5: cmd.exe

(Host: 88, Network: 0)

Information	Value
ID / OS PID	#5 / 0xcac
OS Parent PID	0x990 (c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe)
Initial Working Directory	C:\Users\WI2yhmtI onvScY7Pe\Desktop
File Name	c:\windows\syswow64\cmd.exe
Command Line	"C:\Windows\system32\cmd.exe" /c "C:\Users\WI2YHM~1\AppData\Local\Temp\upd823d0e12.bat"
Monitor	Start Time: 00:01:09, Reason: Child Process
Unmonitor	End Time: 00:01:21, Reason: Terminated
Monitor Duration	00:00:12
OS Thread IDs	#11 0xCB0 #16 0xD00

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x00000000000e0000	0x000e0000	0x000fffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000000e0000	0x000e0000	0x000effff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x00000000000f0000	0x000f0000	0x000f3fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000100000	0x00100000	0x00101fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000100000	0x00100000	0x00103fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000110000	0x00110000	0x00123fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000130000	0x00130000	0x0016ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000170000	0x00170000	0x0026ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000270000	0x00270000	0x00273fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000280000	0x00280000	0x00280fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000290000	0x00290000	0x00291fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000002a0000	0x002a0000	0x002dffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000300000	0x00300000	0x0030ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000320000	0x00320000	0x0041ffff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x00420000	0x004ddfff	Memory Mapped File	Readable	Region Actions
private_0x00000000004e0000	0x004e0000	0x005dffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000700000	0x00700000	0x0070ffff	Private Memory	Readable, Writable	Region Actions
cmd.exe	0x009c0000	0x00a0ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x0000000000a10000	0x00a10000	0x04a0ffff	Pagefile Backed Memory	-	Region Actions
wow64win.dll	0x64da0000	0x64e12fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64.dll	0x64e20000	0x64e6efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wow64cpu.dll	0x64e70000	0x64e77fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cmdext.dll	0x74460000	0x74467fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
bcryptprimitives.dll	0x74470000	0x744c8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x744d0000	0x744d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x744e0000	0x744fdfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x745a0000	0x7465dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x75b70000	0x75c1bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x76460000	0x7654ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x76d70000	0x76deafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x76e90000	0x76ed2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
KernelBase.dll	0x76fa0000	0x77115fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x773d0000	0x77548fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000000007e9f0000	0x7e9f0000	0x7eaeffff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x000000007eaf0000	0x7eaf0000	0x7eb12fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007eb16000	0x7eb16000	0x7eb16fff	Private Memory	Readable, Writable	Region Actions
private_0x000000007eb18000	0x7eb18000	0x7eb1afff	Private Memory	Readable, Writable	Region Actions
private_0x000000007eb1b000	0x7eb1b000	0x7eb1bfff	Private Memory	Readable, Writable	Region Actions
private_0x000000007eb1d000	0x7eb1d000	0x7eb1ffff	Private Memory	Readable, Writable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
private_0x000000007fff0000	0x7fff0000	0x7dfd2ef5ffff	Private Memory	Readable	Region Actions
pagefile_0x00007dfd2ef60000	0x7dfd2ef60000	0x7ffd2ef5ffff	Pagefile Backed Memory	-	Region Actions
ntdll.dll	0x7ffd2ef60000	0x7ffd2f121fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x00007ffd2f122000	0x7ffd2f122000	0x7ffffffeffff	Private Memory	Readable	Region Actions

Host Behavior

File (62)

Operation	Filename	Additional Information	Count	Logfile
CREATE	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING, file_attributes = FILE_ATTRIBUTE_NORMAL	5	Fn
CREATE	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
OPEN	STD_OUTPUT_HANDLE		13	Fn
OPEN	STD_INPUT_HANDLE		7	Fn
OPEN	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat		25	Fn
OPEN	c:\users\wi2yhmti onvscy7pe\desktop\tax tool.exe	desired_access = DELETE, share_mode = FILE_SHARE_DELETE, open_options = FILE_NON_DIRECTORY_FILE, FILE_DELETE_ON_CLOSE, FILE_OPEN_FOR_BACKUP_INTENT	1	Fn
OPEN	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	desired_access = DELETE, share_mode = FILE_SHARE_DELETE, open_options = FILE_NON_DIRECTORY_FILE, FILE_DELETE_ON_CLOSE, FILE_OPEN_FOR_BACKUP_INTENT	1	Fn
OPEN	STD_ERROR_HANDLE		3	Fn
READ	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	size = 8191	1	Fn Data
READ	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	size = 8191	1	Fn Data
READ	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	size = 8191	1	Fn Data
READ	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	size = 8191	1	Fn Data
READ	c:\users\wi2yhm~1\appdata\local\temp\upd823d0e12.bat	size = 8191	1	Fn Data
WRITE	STD_ERROR_HANDLE	size = 33	1	Fn Data

Process (1)

Operation	Process Name	Additional Information	Success	Count	Logfile
SET_CURDIR	c:\windows\syswow64\cmd.exe	os_pid = 0xcac, new_path_name = c:\users\wi2yhmti onvscy7pe\desktop		1	Fn

Module (8)

Operation	Module	Additional Information	Count	Logfile
GET_HANDLE	c:\windows\syswow64\cmd.exe	base_address = 0x9c0000	1	Fn
GET_HANDLE	c:\windows\syswow64\kernel32.dll	base_address = 0x76460000	2	Fn
GET_FILENAME	C:\Windows\SysWOW64\cmd.exe		1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = SetThreadUILanguage, address = 0x764a2780	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = CopyFileExW, address = 0x7647fa80	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = IsDebuggerPresent, address = 0x7647a790	1	Fn
GET_PROC_ADDRESS	c:\windows\syswow64\kernel32.dll	function = SetConsoleInputExeNameW, address = 0x770b35c0	1	Fn

Registry (17)

Operation	Key	Additional Information	Count	Logfile
OPEN_KEY	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System		1	Fn
OPEN_KEY	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor		1	Fn
OPEN_KEY	HKEY_CURRENT_USER\Software\Microsoft\Command Processor		1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data_ident_out = 80	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data_ident_out = 1	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data_ident_out = 1	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data_ident_out = 0	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data_ident_out = 64	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data_ident_out = 64	1	Fn
READ_VALUE	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data_ident_out = 64	1	Fn
READ_VALUE	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data_ident_out = 64	1	Fn
READ_VALUE	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data_ident_out = 1	1	Fn
READ_VALUE	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data_ident_out = 1	1	Fn
READ_VALUE	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data_ident_out = 0	1	Fn
READ_VALUE	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data_ident_out = 9	1	Fn
READ_VALUE	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data_ident_out = 9	1	Fn
READ_VALUE	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data_ident_out = 9	1	Fn