d4de58e7...ea2c | Sequential Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win7_64_sp1 | exe
Classification: Riskware, Wiper, Ransomware

d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c (SHA256)

d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe

Windows Exe (x86-32)

Created at 2018-07-02 12:52:00

...
Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x904 Analysis Target High (Elevated) d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe" -
#2 0x994 Child Process High (Elevated) cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn 2620738370 /rl highest /tr C:\PROGRA~2\COMMON~1\D4DE58~1.EXE #1
#3 0x9ac Child Process High (Elevated) schtasks.exe schtasks /create /sc onlogon /tn 2620738370 /rl highest /tr C:\PROGRA~2\COMMON~1\D4DE58~1.EXE #2
#4 0x5c8 Created Scheduled Job High (Elevated) taskeng.exe taskeng.exe {05965D02-66FE-4C30-84EF-49C2DFC0C57D} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1] #3

Behavior Information - Sequential View

Process #1: d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe
11332 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:27, Reason: Analysis Target
Unmonitor End Time: 00:01:45, Reason: Terminated by Timeout
Monitor Duration 00:01:18
OS Process Information
»
Information Value
PID 0x904
Parent PID 0x564 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 908
0x 918
0x 9B8
0x 9BC
0x A28
0x A2C
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory Readable, Writable True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000060000 0x00060000 0x00061fff Pagefile Backed Memory Readable True False False -
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False -
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable True False False -
pagefile_0x00000000000f0000 0x000f0000 0x000f1fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000100000 0x00100000 0x00100fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000130000 0x00130000 0x0016ffff Private Memory Readable, Writable True False False -
private_0x0000000000180000 0x00180000 0x001bffff Private Memory Readable, Writable True False False -
private_0x00000000001f0000 0x001f0000 0x005effff Private Memory Readable, Writable True False False -
pagefile_0x00000000005f0000 0x005f0000 0x006cefff Pagefile Backed Memory Readable True False False -
rsaenh.dll 0x006d0000 0x0070bfff Memory Mapped File Readable False False False -
private_0x0000000000710000 0x00710000 0x0078ffff Private Memory Readable, Writable True False False -
private_0x0000000000790000 0x00790000 0x0080ffff Private Memory Readable, Writable True False False -
private_0x0000000000810000 0x00810000 0x00890fff Private Memory Readable, Writable True False False -
private_0x0000000000810000 0x00810000 0x0089cfff Private Memory Readable, Writable True False False -
private_0x00000000008b0000 0x008b0000 0x00caffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000cb0000 0x00cb0000 0x00e37fff Pagefile Backed Memory Readable True False False -
private_0x0000000000e90000 0x00e90000 0x00e9ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000ea0000 0x00ea0000 0x01020fff Pagefile Backed Memory Readable True False False -
sortdefault.nls 0x01030000 0x012fefff Memory Mapped File Readable False False False -
d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe 0x013a0000 0x01483fff Memory Mapped File Readable, Writable, Executable True True False
...
pagefile_0x0000000001490000 0x01490000 0x0288ffff Pagefile Backed Memory Readable True False False -
private_0x0000000002890000 0x02890000 0x02a2ffff Private Memory Readable, Writable True False False -
private_0x00000000028e0000 0x028e0000 0x0291ffff Private Memory Readable, Writable True False False -
private_0x0000000002940000 0x02940000 0x0297ffff Private Memory Readable, Writable True False False -
private_0x0000000002990000 0x02990000 0x029cffff Private Memory Readable, Writable True False False -
private_0x00000000029f0000 0x029f0000 0x02a2ffff Private Memory Readable, Writable True False False -
private_0x0000000002a80000 0x02a80000 0x02abffff Private Memory Readable, Writable True False False -
private_0x0000000002ad0000 0x02ad0000 0x02b0ffff Private Memory Readable, Writable True False False -
private_0x0000000002b50000 0x02b50000 0x02f4ffff Private Memory Readable, Writable True False False -
private_0x0000000002f50000 0x02f50000 0x03063fff Private Memory Readable, Writable True False False -
private_0x0000000002f50000 0x02f50000 0x0304ffff Private Memory Readable, Writable True False False -
private_0x00000000030f0000 0x030f0000 0x034effff Private Memory Readable, Writable True False False -
private_0x0000000003570000 0x03570000 0x0396ffff Private Memory Readable, Writable True False False -
private_0x0000000003970000 0x03970000 0x03d72fff Private Memory Readable, Writable True False False -
private_0x0000000003970000 0x03970000 0x03b6ffff Private Memory Readable, Writable True False False -
private_0x0000000003b70000 0x03b70000 0x03c96fff Private Memory Readable, Writable True False False -
private_0x0000000003b70000 0x03b70000 0x03c75fff Private Memory Readable, Writable True False False -
private_0x0000000003e00000 0x03e00000 0x041fffff Private Memory Readable, Writable True False False -
private_0x00000000043e0000 0x043e0000 0x047dffff Private Memory Readable, Writable True False False -
dwmapi.dll 0x752b0000 0x752c2fff Memory Mapped File Readable, Writable, Executable False False False -
uxtheme.dll 0x752d0000 0x7534ffff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x75360000 0x75367fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x75370000 0x753cbfff Memory Mapped File Readable, Writable, Executable False False False -
wow64.dll 0x753d0000 0x7540efff Memory Mapped File Readable, Writable, Executable False False False -
srvcli.dll 0x754e0000 0x754f8fff Memory Mapped File Readable, Writable, Executable False False False -
wkscli.dll 0x75580000 0x7558efff Memory Mapped File Readable, Writable, Executable False False False -
srvcli.dll 0x755a0000 0x755b8fff Memory Mapped File Readable, Writable, Executable False False False -
rsaenh.dll 0x755a0000 0x755dafff Memory Mapped File Readable, Writable, Executable False False False -
netapi32.dll 0x755b0000 0x755c0fff Memory Mapped File Readable, Writable, Executable False False False -
netutils.dll 0x755c0000 0x755c8fff Memory Mapped File Readable, Writable, Executable False False False -
netapi32.dll 0x755e0000 0x755f0fff Memory Mapped File Readable, Writable, Executable False False False -
wkscli.dll 0x755e0000 0x755eefff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x755e0000 0x755f5fff Memory Mapped File Readable, Writable, Executable False False False -
netutils.dll 0x755f0000 0x755f8fff Memory Mapped File Readable, Writable, Executable False False False -
wsock32.dll 0x75600000 0x75606fff Memory Mapped File Readable, Writable, Executable False False False -
winmm.dll 0x75610000 0x75641fff Memory Mapped File Readable, Writable, Executable False False False -
version.dll 0x75650000 0x75658fff Memory Mapped File Readable, Writable, Executable False False False -
profapi.dll 0x75660000 0x7566afff Memory Mapped File Readable, Writable, Executable False False False -
userenv.dll 0x75670000 0x75686fff Memory Mapped File Readable, Writable, Executable False False False -
mpr.dll 0x75690000 0x756a1fff Memory Mapped File Readable, Writable, Executable False False False -
winnsi.dll 0x756b0000 0x756b6fff Memory Mapped File Readable, Writable, Executable False False False -
iphlpapi.dll 0x756c0000 0x756dbfff Memory Mapped File Readable, Writable, Executable False False False -
comctl32.dll 0x756e0000 0x7587dfff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x75980000 0x7598bfff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x75990000 0x759effff Memory Mapped File Readable, Writable, Executable False False False -
psapi.dll 0x75a20000 0x75a24fff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x75a30000 0x75a48fff Memory Mapped File Readable, Writable, Executable False False False -
nsi.dll 0x75a50000 0x75a55fff Memory Mapped File Readable, Writable, Executable False False False -
crypt32.dll 0x75a60000 0x75b7cfff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x75bb0000 0x75bf5fff Memory Mapped File Readable, Writable, Executable False False False -
iertutil.dll 0x75dd0000 0x75fcafff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x75fd0000 0x760dffff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x760e0000 0x7617ffff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x76180000 0x761d6fff Memory Mapped File Readable, Writable, Executable False False False -
urlmon.dll 0x76240000 0x76375fff Memory Mapped File Readable, Writable, Executable False False False -
ws2_32.dll 0x76380000 0x763b4fff Memory Mapped File Readable, Writable, Executable False False False -
lpk.dll 0x763c0000 0x763c9fff Memory Mapped File Readable, Writable, Executable False False False -
msasn1.dll 0x763d0000 0x763dbfff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x763e0000 0x764dffff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x764e0000 0x7656efff Memory Mapped File Readable, Writable, Executable False False False -
wininet.dll 0x76570000 0x76664fff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x76670000 0x7671bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76720000 0x767ebfff Memory Mapped File Readable, Writable, Executable False False False -
comdlg32.dll 0x767f0000 0x7686afff Memory Mapped File Readable, Writable, Executable False False False -
shell32.dll 0x76920000 0x77569fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x77570000 0x775cffff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x775d0000 0x776bffff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x776c0000 0x7781bfff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x77820000 0x778affff Memory Mapped File Readable, Writable, Executable False False False -
usp10.dll 0x77990000 0x77a2cfff Memory Mapped File Readable, Writable, Executable False False False -
private_0x0000000077a30000 0x77a30000 0x77b4efff Private Memory Readable, Writable, Executable True False False -
private_0x0000000077b50000 0x77b50000 0x77c49fff Private Memory Readable, Writable, Executable True False False -
ntdll.dll 0x77c50000 0x77df8fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77e30000 0x77faffff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x00000000fffa7000 0xfffa7000 0xfffa9fff Private Memory Readable, Writable True False False -
private_0x00000000fffaa000 0xfffaa000 0xfffacfff Private Memory Readable, Writable True False False -
private_0x00000000fffad000 0xfffad000 0xfffaffff Private Memory Readable, Writable True False False -
pagefile_0x00000000fffb0000 0xfffb0000 0xfffd2fff Pagefile Backed Memory Readable True False False -
private_0x00000000fffd5000 0xfffd5000 0xfffd7fff Private Memory Readable, Writable True False False -
private_0x00000000fffd8000 0xfffd8000 0xfffdafff Private Memory Readable, Writable True False False -
private_0x00000000fffdb000 0xfffdb000 0xfffddfff Private Memory Readable, Writable True False False -
private_0x00000000fffde000 0xfffde000 0xfffdefff Private Memory Readable, Writable True False False -
private_0x00000000fffdf000 0xfffdf000 0xfffdffff Private Memory Readable, Writable True False False -
private_0x00000000fffe0000 0xfffe0000 0x7fffffeffff Private Memory Readable True False False -
Created Files
»
Filename File Size Hash Values YARA Match Actions
c:\progra~2\common~1\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\progra~2\common~1\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe 355.50 KB MD5: 8893004b04b4436eb47e9b504b7a437f
SHA1: 29b18de4657e00cabc41b3600e753ef51960cd21
SHA256: d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\1033\structuredqueryschema.king_ouroboros.bin 34.82 KB MD5: f2ad2da14dd24935bfcde62777728563
SHA1: e6f252a00c7d507dd84dacf31a0903b14e4abb07
SHA256: d3720bff0369475d216c957505505cc2809f0b661e7de2fe5e75a6416cbdf76d 		False
...
Threads
Thread 0x908
11332 0
»
Category Operation Information Success Count Logfile
Module Load module_name = KERNEL32.DLL, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75fe1886 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75fe34d5 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75fe1136 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77e5e026 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75fe14e9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75fe14c9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75fe10ff True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75fe1450 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75fe192e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = MulDiv, address_out = 0x75fe1b80 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetVersionExW, address_out = 0x75fe1ae5 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75fe195e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemInfo, address_out = 0x75fe49ca True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibrary, address_out = 0x75fe34c8 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryA, address_out = 0x75fe49d7 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75fe1222 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetErrorMode, address_out = 0x75fe1b00 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75fe4950 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75fe170d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = lstrcpyW, address_out = 0x76003102 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = lstrlenW, address_out = 0x75fe1700 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75fe34b0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75fe1725 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = VirtualFreeEx, address_out = 0x75ffd9c8 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75fe1986 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = VirtualAllocEx, address_out = 0x75ffd9b0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = WriteProcessMemory, address_out = 0x75ffd9e0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = ReadProcessMemory, address_out = 0x75ffcfcc True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75fe3f5c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75ffc807 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75ffce2e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75fe3ed3 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75fe1282 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75fe469b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ffd802 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateToolhelp32Snapshot, address_out = 0x7600735f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = Process32FirstW, address_out = 0x76008baf True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = Process32NextW, address_out = 0x7600896c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetFileTime, address_out = 0x75ffecbb True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetFileAttributesW, address_out = 0x75fe1b18 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FindFirstFileW, address_out = 0x75fe4435 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetCurrentDirectoryW, address_out = 0x75ff1260 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetLongPathNameW, address_out = 0x75fea315 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetShortPathNameW, address_out = 0x75fed2f9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75fe89b3 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FindNextFileW, address_out = 0x75fe54ee True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x76003b92 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = MoveFileW, address_out = 0x75ff9af0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateDirectoryW, address_out = 0x75fe4259 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = RemoveDirectoryW, address_out = 0x760644cf True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetSystemPowerState, address_out = 0x760629b9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceFrequency, address_out = 0x75fe41f0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75fe5971 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75fe594c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75fe5959 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75fe5ac9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = EnumResourceNamesW, address_out = 0x76053161 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x7600d1d4 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetTempPathW, address_out = 0x75ffd4dc True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetTempFileNameW, address_out = 0x7600d1b6 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75fe322f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetLocalTime, address_out = 0x75fe5aa6 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringW, address_out = 0x75fe3bca True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75fe1809 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77e522b0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77e52270 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75fe51b3 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreatePipe, address_out = 0x7606415b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = InterlockedExchange, address_out = 0x75fe1462 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75fe7a2f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75fe495d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceExW, address_out = 0x75fe3299 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileW, address_out = 0x7600830d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = VirtualFree, address_out = 0x75fe186e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75fe4620 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetExitCodeProcess, address_out = 0x75ff174d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetPrivateProfileStringW, address_out = 0x75feea48 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = WritePrivateProfileStringW, address_out = 0x7600640c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetPrivateProfileSectionW, address_out = 0x76006b1a True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = WritePrivateProfileSectionW, address_out = 0x7605a181 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetPrivateProfileSectionNamesW, address_out = 0x7605a1ea True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FileTimeToLocalFileTime, address_out = 0x75fee29e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FileTimeToSystemTime, address_out = 0x75fe542c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SystemTimeToFileTime, address_out = 0x75fe5a7e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LocalFileTimeToFileTime, address_out = 0x7600d50e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75fe418b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetDiskFreeSpaceExW, address_out = 0x75ffd50f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetDiskFreeSpaceW, address_out = 0x75fff7aa True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetVolumeInformationW, address_out = 0x75ffc860 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetVolumeLabelW, address_out = 0x7606255b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateHardLinkW, address_out = 0x7606d618 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetFileAttributesW, address_out = 0x75ffd4f7 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75fe183e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75fe16c5 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentVariableW, address_out = 0x75fe1b48 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetEnvironmentVariableW, address_out = 0x75fe89f1 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GlobalLock, address_out = 0x75ffd0a7 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GlobalUnlock, address_out = 0x75ffcfdf True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GlobalAlloc, address_out = 0x75fe588e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetFileSize, address_out = 0x75fe196e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GlobalFree, address_out = 0x75fe5558 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GlobalMemoryStatusEx, address_out = 0x7600d4c4 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = Beep, address_out = 0x760552e8 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75fe5063 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77e71f6e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77e63002 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetComputerNameW, address_out = 0x75fedd0e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetWindowsDirectoryW, address_out = 0x75fe43e2 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75fe11f8 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessIoCounters, address_out = 0x76063116 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75fe103d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessId, address_out = 0x7600cf04 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetPriorityClass, address_out = 0x75ffcf28 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75fe492b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = VirtualAlloc, address_out = 0x75fe1856 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75fe4a5d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentDirectoryW, address_out = 0x75fe5611 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiW, address_out = 0x75ffd5cd True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77e69d35 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75fe11c0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = RaiseException, address_out = 0x75fe58a6 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75fe1916 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77e645f5 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = InterlockedDecrement, address_out = 0x75fe13f0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = InterlockedIncrement, address_out = 0x75fe1400 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThread, address_out = 0x75fe17ec True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75fe1410 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetFullPathNameW, address_out = 0x75fe40d4 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77e70fcb True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75fe7a10 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75fe4a6f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77e8d598 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75fe3509 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = ResumeThread, address_out = 0x75fe43ef True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75fe5223 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75fe5235 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75fe4493 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75fe179c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x7600d1a1 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75fe5189 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75fe11a9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x7600772f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75fe87c9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75fe49ad True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75fe11e0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75fe14fb True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75fe3587 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75fe4d40 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75fe1946 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x7606454f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75fe3531 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x76087bff True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75fe1328 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x7600d1c3 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x7608739a True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeZoneInformation, address_out = 0x75fe465a True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatW, address_out = 0x760034d7 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatW, address_out = 0x75fff481 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75fe17b9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75fe51e3 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75fe51cb True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x76007aca True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FindClose, address_out = 0x75fe4442 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetEnvironmentVariableA, address_out = 0x75fee331 True 1
Fn
Module Load module_name = ADVAPI32.dll, base_address = 0x760e0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = GetAce, address_out = 0x760f45f0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegEnumValueW, address_out = 0x760f48cc True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteValueW, address_out = 0x760ecf31 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x760f1272 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegEnumKeyExW, address_out = 0x760f46c8 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x760f14d6 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x760f468d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x760f469d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x760f46ad True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegConnectRegistryW, address_out = 0x760e8f01 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = InitializeSecurityDescriptor, address_out = 0x760f4620 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = InitializeAcl, address_out = 0x760f45cd True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x760f418e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = OpenThreadToken, address_out = 0x760f432c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x760f4304 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x760f41b3 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = DuplicateTokenEx, address_out = 0x760eca24 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = CreateProcessAsUserW, address_out = 0x760ec592 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = CreateProcessWithLogonW, address_out = 0x761252e9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = GetLengthSid, address_out = 0x760f413b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = CopySid, address_out = 0x760f444e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = LogonUserW, address_out = 0x760ec1a9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = AllocateAndInitializeSid, address_out = 0x760f40e6 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = CheckTokenMembership, address_out = 0x760edf04 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyExW, address_out = 0x760f40fe True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = FreeSid, address_out = 0x760f412e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x760f431c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = GetSecurityDescriptorDacl, address_out = 0x760f41a6 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = GetAclInformation, address_out = 0x760ecc89 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = AddAce, address_out = 0x760eae0f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = SetSecurityDescriptorDacl, address_out = 0x760f415e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = GetUserNameW, address_out = 0x760f157a True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = InitiateSystemShutdownExW, address_out = 0x7613db3a True 1
Fn
Module Load module_name = COMCTL32.dll, base_address = 0x756e0000 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_ReplaceIcon, address_out = 0x757110b3 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_Destroy, address_out = 0x756f6471 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_Remove, address_out = 0x7570e333 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_SetDragCursorImage, address_out = 0x757caf46 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_BeginDrag, address_out = 0x757cb021 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_DragEnter, address_out = 0x757cb0b3 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_DragLeave, address_out = 0x757cb12a True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_EndDrag, address_out = 0x757ca177 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_DragMove, address_out = 0x757cb0f0 True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = InitCommonControlsEx, address_out = 0x757009ce True 1
Fn
Module Get Address module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll, function = ImageList_Create, address_out = 0x756f3c75 True 1
Fn
Module Load module_name = COMDLG32.dll, base_address = 0x767f0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\comdlg32.dll, function = GetOpenFileNameW, address_out = 0x7682a2d5 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\comdlg32.dll, function = GetSaveFileNameW, address_out = 0x7682a36e True 1
Fn
Module Load module_name = GDI32.dll, base_address = 0x77820000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = StrokePath, address_out = 0x7786573f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = DeleteObject, address_out = 0x77835689 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = GetTextExtentPoint32W, address_out = 0x7783c107 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = ExtCreatePen, address_out = 0x7784c39b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x77834de0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = EndPath, address_out = 0x77865506 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = SetPixel, address_out = 0x7783ccee True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = CloseFigure, address_out = 0x778654af True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = CreateCompatibleBitmap, address_out = 0x77835f49 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = CreateCompatibleDC, address_out = 0x778354f4 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = SelectObject, address_out = 0x77834f70 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = StretchBlt, address_out = 0x7783b895 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = GetDIBits, address_out = 0x77836001 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = LineTo, address_out = 0x7783b9e5 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = AngleArc, address_out = 0x77864124 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = MoveToEx, address_out = 0x77838ee6 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = Ellipse, address_out = 0x77864492 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = DeleteDC, address_out = 0x778358b3 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = GetPixel, address_out = 0x7783cbfb True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = CreateDCW, address_out = 0x7783e743 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = GetStockObject, address_out = 0x77834eb8 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = GetTextFaceW, address_out = 0x77839936 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = CreateFontW, address_out = 0x7783b600 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = SetTextColor, address_out = 0x7783522d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = PolyDraw, address_out = 0x77865d87 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = BeginPath, address_out = 0x778653fd True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = Rectangle, address_out = 0x7783a53a True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = SetViewportOrgEx, address_out = 0x778386cc True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = GetObjectW, address_out = 0x77836c3a True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = SetBkMode, address_out = 0x778351a2 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = RoundRect, address_out = 0x77846cde True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = SetBkColor, address_out = 0x778352d8 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = CreatePen, address_out = 0x7783ba4f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = CreateSolidBrush, address_out = 0x77834f17 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\gdi32.dll, function = StrokeAndFillPath, address_out = 0x778656ac True 1
Fn
Module Load module_name = IPHLPAPI.DLL, base_address = 0x756c0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\iphlpapi.dll, function = IcmpCreateFile, address_out = 0x756c8666 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\iphlpapi.dll, function = IcmpCloseHandle, address_out = 0x756c821a True 1
Fn
Module Get Address module_name = c:\windows\syswow64\iphlpapi.dll, function = IcmpSendEcho, address_out = 0x756c870b True 1
Fn
Module Load module_name = MPR.dll, base_address = 0x75690000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\mpr.dll, function = WNetUseConnectionW, address_out = 0x75694769 True 1
Fn
Module Load module_name = ole32.dll, base_address = 0x776c0000 True 1
Fn
Module Load module_name = OLEAUT32.dll, base_address = 0x764e0000 True 1
Fn
Module Load module_name = PSAPI.DLL, base_address = 0x75a20000 True 1
Fn
Module Load module_name = SHELL32.dll, base_address = 0x76920000 True 1
Fn
Module Load module_name = USER32.dll, base_address = 0x763e0000 True 1
Fn
Module Load module_name = USERENV.dll, base_address = 0x75670000 True 1
Fn
Module Load module_name = UxTheme.dll, base_address = 0x752d0000 True 1
Fn
Module Load module_name = VERSION.dll, base_address = 0x75650000 True 1
Fn
Module Load module_name = WININET.dll, base_address = 0x76570000 True 1
Fn
Module Load module_name = WINMM.dll, base_address = 0x75610000 True 1
Fn
Module Load module_name = WSOCK32.dll, base_address = 0x75600000 True 1
Fn
System Get Time type = System Time, time = 2018-07-02 12:52:52 (UTC) True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75fe4f2b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75fe359f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75fe1252 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75fe4208 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75fe4d28 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x7606410b True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x76064195 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75fed31f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ffee7e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77e7441c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77e9c50e True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77e9c381 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75fff088 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77e805d7 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77e9ca24 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77e50b8c True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77f0fde8 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77ea1e1d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x76064761 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x7605cd11 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x7606424f True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x760646b1 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x76076676 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x76064751 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x760765f1 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x760647c1 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x760647e1 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x760647f1 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ffeee0 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Filename process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, size = 260 True 1
Fn
System Get Info type = Operating System True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = GetNativeSystemInfo, address_out = 0x75ff10b5 True 1
Fn
System Get Info type = Hardware Information True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Control Panel\Mouse True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Control Panel\Mouse, value_name = SwapMouseButtons, data = 48 True 1
Fn
Module Get Filename process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, size = 32767 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\AutoIt v3\AutoIt False 1
Fn
Module Get Filename process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, size = 32767 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ffd650 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Get Info filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, type = file_type True 1
Fn
Module Load module_name = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, base_address = 0x13a0000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = Wow64RevertWow64FsRedirection, address_out = 0x75ffd668 True 1
Fn
System Get Time type = System Time, time = 2018-07-02 12:52:52 (UTC) True 5
Fn
Debug Check for Presence c:\users\5p5nrgjn0js halpmcxz\desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ffd650 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Get Info filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, type = file_type True 1
Fn
Module Load module_name = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, base_address = 0x13a0000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = Wow64RevertWow64FsRedirection, address_out = 0x75ffd668 True 1
Fn
System Get Time type = System Time, time = 2018-07-02 12:52:53 (UTC) True 8
Fn
Window Create window_name = AutoIt v3, class_name = AutoIt v3, wndproc_parameter = 0 True 1
Fn
System Sleep duration = 750 milliseconds (0.750 seconds) True 1
Fn
Window Create class_name = edit, wndproc_parameter = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Mutex Create mutex_name = 8gf3892489g09j True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
System Get Time type = System Time, time = 2018-07-02 12:52:53 (UTC) True 1
Fn
System Sleep duration = 750 milliseconds (0.750 seconds) True 10
Fn
File Copy source_filename = C:\Users\5P5NRG~1\Desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, destination_filename = C:\PROGRA~2\COMMON~1\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe, copy_flags = COPY_FILE_ALLOW_DECRYPTED_DESTINATION True 1
Fn
Process Create process_name = C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn 2620738370 /rl highest /tr C:\PROGRA~2\COMMON~1\D4DE58~1.EXE, os_pid = 0x994, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, value_name = EnableLinkedConnections, type = REG_NONE False 1
Fn
Module Load module_name = Netapi32.dll, base_address = 0x755e0000 True 1
Fn
System Sleep duration = 750 milliseconds (0.750 seconds) True 1
Fn
Module Load module_name = Netapi32.dll, base_address = 0x755b0000 True 1
Fn
Module Load module_name = netapi32.dll, base_address = 0x755e0000 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PublishingWizard\AddNetworkPlace\AddNetPlace\LocationMRU False 1
Fn
System Sleep duration = 750 milliseconds (0.750 seconds) True 4
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.king_ouroboros.lst, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst, size = 65536, size_out = 35116 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.king_ouroboros.lst, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst, size = 65536, size_out = 65536 True 2
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst, size = 65536, size_out = 7387 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 98 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.king_ouroboros.lst, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst, size = 65536, size_out = 53188 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 195 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.king_ouroboros.0 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.king_ouroboros.0\SharedDataEvents, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
System Sleep duration = 750 milliseconds (0.750 seconds) True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents, size = 65536, size_out = 5120 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 294 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.king_ouroboros.bin, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin, size = 65536, size_out = 65536 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin, size = 65536, size_out = 11941 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 390 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.king_ouroboros.icc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc, size = 65536, size_out = 65536 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc, size = 65536, size_out = 672 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 483 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.king_ouroboros.icc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc, size = 65536, size_out = 2676 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 575 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.king_ouroboros.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe, size = 65536, size_out = 65536 True 16
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe, size = 65536, size_out = 65536 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe, size = 65536, size_out = 16216 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 666 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.king_ouroboros.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe, size = 65536, size_out = 15440 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 843 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.king_ouroboros.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms, size = 65536, size_out = 17104 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 1017 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.king_ouroboros.manifest, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest, size = 65536, size_out = 13643 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest, size = 65536, size_out = 0 True 1
Fn
System Sleep duration = 750 milliseconds (0.750 seconds) True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 1198 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.king_ouroboros.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms, size = 65536, size_out = 3808 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 1381 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.manifest, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.king_ouroboros.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe, size = 65536, size_out = 65536 True 16
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe, size = 65536, size_out = 65536 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe, size = 65536, size_out = 16216 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 1567 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.king_ouroboros.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms, size = 65536, size_out = 17104 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 1739 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.king_ouroboros.manifest, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest, size = 65536, size_out = 13643 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 1911 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.king_ouroboros.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms, size = 65536, size_out = 14512 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 2085 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.king_ouroboros.manifest, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest, size = 65536, size_out = 11824 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 2257 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.king_ouroboros.DAT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT, size = 65536, size_out = 65536 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT, size = 65536, size_out = 43288 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 2431 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Crashpad\metadata, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0, size = 65536, size_out = 45056 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 2511 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
System Sleep duration = 750 milliseconds (0.750 seconds) True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1, size = 65536, size_out = 65536 True 4
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1, size = 65536, size_out = 8192 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 2618 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2, size = 65536, size_out = 8192 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 2725 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, size = 65536, size_out = 65536 True 16
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, size = 65536, size_out = 65536 True 16
Fn
Data
System Sleep duration = 750 milliseconds (0.750 seconds) True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, size = 65536, size_out = 65536 True 16
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, size = 65536, size_out = 65536 True 16
Fn
Data
System Sleep duration = 750 milliseconds (0.750 seconds) True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, size = 65536, size_out = 8192 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3 True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 2832 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\index, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\index, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\index, size = 65536, size_out = 65536 True 8
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\index, size = 65536, size_out = 368 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\index, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\index, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\index True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 2939 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies, size = 65536, size_out = 7168 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 3045 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Current Session, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Current Tabs, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000003.log, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOCK, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOCK, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000001, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.king_ouroboros.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png, size = 65536, size_out = 3372 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 3147 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_16.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\main.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\main.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\manifest.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ar\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\bg\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ca\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\cs\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\da\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\de\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\el\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\en_GB\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\en_US\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\es\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\es_419\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\et\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fi\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fil\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fr\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\he\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hi\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hu\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\id\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\it\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ja\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ko\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lt\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lv\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ms\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\nl\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\no\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pl\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_BR\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_PT\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ro\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ru\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sk\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sl\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sr\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sv\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\th\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\tr\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\uk\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\vi\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\zh_CN\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\zh_TW\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\computed_hashes.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\verified_contents.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
System Sleep duration = 750 milliseconds (0.750 seconds) True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\verified_contents.json, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\verified_contents.king_ouroboros.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\verified_contents.json, size = 65536, size_out = 11094 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\verified_contents.json, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\verified_contents.json, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\verified_contents.json True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 3302 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Load module_name = Advapi32.dll, base_address = 0x760e0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.king_ouroboros.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png, size = 65536, size_out = 3213 True 1
Fn
Data
File Read filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = msvcrt.dll, base_address = 0x76670000 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png, desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Delete filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png True 1
Fn
File Create filename = C:\PROGRA~2\COMMON~1\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE True 1
Fn
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 3477 True 1
Fn
Data
File Read filename = C:\PROGRA~2\COMMON~1\log.txt, size = 65536, size_out = 0 True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 1
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_16.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\main.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\main.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\manifest.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ar\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\bg\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ca\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\cs\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\da\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\de\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\el\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\en_GB\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\en_US\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\es\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\es_419\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\et\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fi\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fil\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fr\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\he\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\hi\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\hu\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\id\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\it\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ja\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ko\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\lt\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\lv\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ms\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\nl\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\no\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pl\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pt_BR\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pt_PT\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
File Create filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ro\messages.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Module Load module_name = kernel32.dll, base_address = 0x75fd0000 True 2
Fn
For performance reasons, the remaining 7841 entries are omitted.
The remaining entries can be found in glog.xml.
Process #2: cmd.exe
56 0
»
Information Value
ID #2
File Name c:\windows\syswow64\cmd.exe
Command Line C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn 2620738370 /rl highest /tr C:\PROGRA~2\COMMON~1\D4DE58~1.EXE
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:40, Reason: Child Process
Unmonitor End Time: 00:01:45, Reason: Terminated by Timeout
Monitor Duration 00:01:05
OS Process Information
»
Information Value
PID 0x994
Parent PID 0x904 (c:\users\5p5nrgjn0js halpmcxz\desktop\d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 998
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000080000 0x00080000 0x00080fff Private Memory Readable, Writable True False False -
private_0x0000000000090000 0x00090000 0x00090fff Private Memory Readable, Writable True False False -
private_0x00000000000c0000 0x000c0000 0x0013ffff Private Memory Readable, Writable True False False -
locale.nls 0x00140000 0x001a6fff Memory Mapped File Readable False False False -
private_0x00000000001b0000 0x001b0000 0x001effff Private Memory Readable, Writable True False False -
private_0x0000000000200000 0x00200000 0x002fffff Private Memory Readable, Writable True False False -
private_0x0000000000350000 0x00350000 0x0044ffff Private Memory Readable, Writable True False False -
private_0x00000000005c0000 0x005c0000 0x005cffff Private Memory Readable, Writable True False False -
pagefile_0x00000000005d0000 0x005d0000 0x00757fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000760000 0x00760000 0x008e0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000008f0000 0x008f0000 0x01ceffff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000001cf0000 0x01cf0000 0x02032fff Pagefile Backed Memory Readable True False False -
sortdefault.nls 0x02040000 0x0230efff Memory Mapped File Readable False False False -
cmd.exe 0x4a630000 0x4a67bfff Memory Mapped File Readable, Writable, Executable True False False -
wow64cpu.dll 0x75360000 0x75367fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x75370000 0x753cbfff Memory Mapped File Readable, Writable, Executable False False False -
wow64.dll 0x753d0000 0x7540efff Memory Mapped File Readable, Writable, Executable False False False -
winbrand.dll 0x755d0000 0x755d6fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x75980000 0x7598bfff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x75990000 0x759effff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x75a30000 0x75a48fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x75bb0000 0x75bf5fff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x75fd0000 0x760dffff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x760e0000 0x7617ffff Memory Mapped File Readable, Writable, Executable False False False -
lpk.dll 0x763c0000 0x763c9fff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x763e0000 0x764dffff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x76670000 0x7671bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76720000 0x767ebfff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x77570000 0x775cffff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x775d0000 0x776bffff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x77820000 0x778affff Memory Mapped File Readable, Writable, Executable False False False -
usp10.dll 0x77990000 0x77a2cfff Memory Mapped File Readable, Writable, Executable False False False -
private_0x0000000077a30000 0x77a30000 0x77b4efff Private Memory Readable, Writable, Executable True False False -
private_0x0000000077b50000 0x77b50000 0x77c49fff Private Memory Readable, Writable, Executable True False False -
ntdll.dll 0x77c50000 0x77df8fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77e30000 0x77faffff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False -
Threads
Thread 0x998
56 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-07-02 12:53:01 (UTC) True 1
Fn
System Get Time type = Ticks, time = 103085 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\cmd.exe, base_address = 0x4a630000 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ffa84f True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String - True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT False 1
Fn
Environment Set Environment String name = PROMPT, value = $P$G True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75fd0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x76003b92 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75fe4a5d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x75ffa79d True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Process Create process_name = C:\Windows\system32\schtasks.exe, os_pid = 0x9ac, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Process #3: schtasks.exe
21 0
»
Information Value
ID #3
File Name c:\windows\syswow64\schtasks.exe
Command Line schtasks /create /sc onlogon /tn 2620738370 /rl highest /tr C:\PROGRA~2\COMMON~1\D4DE58~1.EXE
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:40, Reason: Child Process
Unmonitor End Time: 00:01:45, Reason: Terminated by Timeout
Monitor Duration 00:01:05
OS Process Information
»
Information Value
PID 0x9ac
Parent PID 0x994 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9B0
0x 9B4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x0000000000050000 0x00050000 0x0008ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000090000 0x00090000 0x00093fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000000a0000 0x000a0000 0x000a0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000000b0000 0x000b0000 0x000b1fff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000000000c0000 0x000c0000 0x0013ffff Private Memory Readable, Writable True False False -
schtasks.exe.mui 0x00140000 0x00151fff Memory Mapped File Readable, Writable False False False -
private_0x0000000000160000 0x00160000 0x00160fff Private Memory Readable, Writable True False False -
private_0x0000000000170000 0x00170000 0x001affff Private Memory Readable, Writable True False False -
private_0x00000000001b0000 0x001b0000 0x001b0fff Private Memory Readable, Writable True False False -
private_0x00000000001c0000 0x001c0000 0x002bffff Private Memory Readable, Writable True False False -
locale.nls 0x002c0000 0x00326fff Memory Mapped File Readable False False False -
pagefile_0x0000000000330000 0x00330000 0x0040efff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000410000 0x00410000 0x00410fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000420000 0x00420000 0x00420fff Pagefile Backed Memory Readable True False False -
private_0x0000000000450000 0x00450000 0x0045ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000460000 0x00460000 0x005e7fff Pagefile Backed Memory Readable True False False -
schtasks.exe 0x00670000 0x0069dfff Memory Mapped File Readable, Writable, Executable True False False -
pagefile_0x00000000006a0000 0x006a0000 0x00820fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000830000 0x00830000 0x01c2ffff Pagefile Backed Memory Readable True False False -
sortdefault.nls 0x01c30000 0x01efefff Memory Mapped File Readable False False False -
private_0x0000000001f00000 0x01f00000 0x0206ffff Private Memory Readable, Writable True False False -
private_0x0000000001fc0000 0x01fc0000 0x01ffffff Private Memory Readable, Writable True False False -
private_0x0000000002030000 0x02030000 0x0206ffff Private Memory Readable, Writable True False False -
private_0x0000000002120000 0x02120000 0x0215ffff Private Memory Readable, Writable True False False -
uxtheme.dll 0x752d0000 0x7534ffff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x75360000 0x75367fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x75370000 0x753cbfff Memory Mapped File Readable, Writable, Executable False False False -
wow64.dll 0x753d0000 0x7540efff Memory Mapped File Readable, Writable, Executable False False False -
taskschd.dll 0x75500000 0x7557cfff Memory Mapped File Readable, Writable, Executable False False False -
ktmw32.dll 0x75590000 0x75598fff Memory Mapped File Readable, Writable, Executable False False False -
xmllite.dll 0x755a0000 0x755cefff Memory Mapped File Readable, Writable, Executable False False False -
version.dll 0x75650000 0x75658fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x75980000 0x7598bfff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x75990000 0x759effff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x75a30000 0x75a48fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x75bb0000 0x75bf5fff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x75fd0000 0x760dffff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x760e0000 0x7617ffff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x76180000 0x761d6fff Memory Mapped File Readable, Writable, Executable False False False -
lpk.dll 0x763c0000 0x763c9fff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x763e0000 0x764dffff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x764e0000 0x7656efff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x76670000 0x7671bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76720000 0x767ebfff Memory Mapped File Readable, Writable, Executable False False False -
clbcatq.dll 0x76890000 0x76912fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x77570000 0x775cffff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x775d0000 0x776bffff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x776c0000 0x7781bfff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x77820000 0x778affff Memory Mapped File Readable, Writable, Executable False False False -
usp10.dll 0x77990000 0x77a2cfff Memory Mapped File Readable, Writable, Executable False False False -
private_0x0000000077a30000 0x77a30000 0x77b4efff Private Memory Readable, Writable, Executable True False False -
private_0x0000000077b50000 0x77b50000 0x77c49fff Private Memory Readable, Writable, Executable True False False -
ntdll.dll 0x77c50000 0x77df8fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77e30000 0x77faffff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False -
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False -
Threads
Thread 0x9b0
21 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2018-07-02 12:53:01 (UTC) True 1
Fn
System Get Time type = Ticks, time = 103210 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\schtasks.exe, base_address = 0x670000 True 1
Fn
Module Get Filename process_name = c:\windows\syswow64\schtasks.exe, file_name_orig = C:\Windows\SysWOW64\schtasks.exe, size = 260 True 1
Fn
Module Load module_name = VERSION.dll, base_address = 0x75650000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x756519d9 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x756519f4 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x75651b51 True 1
Fn
Module Get Filename process_name = c:\windows\syswow64\schtasks.exe, file_name_orig = C:\Windows\SysWOW64\schtasks.exe, size = 260 True 1
Fn
System Get Time type = Local Time, time = 2018-07-02 22:53:01 (Local Time) True 2
Fn
COM Create interface = 2FABA4C7-4DA9-4013-9697-20CC3FD40F85, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
System Get Time type = Local Time, time = 2018-07-02 22:53:01 (Local Time) True 1
Fn
Module Load module_name = ADVAPI32.dll, base_address = 0x760e0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = GetUserNameW, address_out = 0x760f157a True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Write filename = STD_OUTPUT_HANDLE, size = 72 True 1
Fn
Data
Process #4: taskeng.exe
0 0
»
Information Value
ID #4
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {05965D02-66FE-4C30-84EF-49C2DFC0C57D} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:41, Reason: Created Scheduled Job
Unmonitor End Time: 00:01:45, Reason: Terminated by Timeout
Monitor Duration 00:01:04
Remarks No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x5c8
Parent PID 0x360 (c:\windows\system32\svchost.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 980
0x 64C
0x 648
0x 5E0
0x 5D4
0x 5CC
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False -
pagefile_0x00000000000c0000 0x000c0000 0x000c1fff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000000000d0000 0x000d0000 0x000d0fff Private Memory Readable, Writable True False False -
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable True False False -
private_0x00000000000f0000 0x000f0000 0x0016ffff Private Memory Readable, Writable True False False -
private_0x0000000000170000 0x00170000 0x0026ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000270000 0x00270000 0x00270fff Pagefile Backed Memory Readable True False False -
private_0x0000000000280000 0x00280000 0x0037ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000380000 0x00380000 0x00507fff Pagefile Backed Memory Readable True False False -
private_0x0000000000520000 0x00520000 0x0052ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000530000 0x00530000 0x006b0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000006c0000 0x006c0000 0x01abffff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000001ac0000 0x01ac0000 0x01eb2fff Pagefile Backed Memory Readable True False False -
private_0x0000000001ed0000 0x01ed0000 0x01f4ffff Private Memory Readable, Writable True False False -
private_0x0000000001f50000 0x01f50000 0x0204ffff Private Memory Readable, Writable True False False -
private_0x00000000020d0000 0x020d0000 0x0214ffff Private Memory Readable, Writable True False False -
private_0x00000000021a0000 0x021a0000 0x0221ffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x022f0000 0x025befff Memory Mapped File Readable False False False -
private_0x0000000002670000 0x02670000 0x026effff Private Memory Readable, Writable True False False -
private_0x0000000002720000 0x02720000 0x0279ffff Private Memory Readable, Writable True False False -
private_0x00000000027a0000 0x027a0000 0x0281ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000002820000 0x02820000 0x028fefff Pagefile Backed Memory Readable True False False -
private_0x0000000002920000 0x02920000 0x0299ffff Private Memory Readable, Writable True False False -
kernel32.dll 0x77a30000 0x77b4efff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x77b50000 0x77c49fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c50000 0x77df8fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
taskeng.exe 0xff0f0000 0xff163fff Memory Mapped File Readable, Writable, Executable False False False -
tschannel.dll 0x7fef83c0000 0x7fef83c8fff Memory Mapped File Readable, Writable, Executable False False False -
ktmw32.dll 0x7fefb290000 0x7fefb299fff Memory Mapped File Readable, Writable, Executable False False False -
xmllite.dll 0x7fefc050000 0x7fefc084fff Memory Mapped File Readable, Writable, Executable False False False -
dwmapi.dll 0x7fefc090000 0x7fefc0a7fff Memory Mapped File Readable, Writable, Executable False False False -
uxtheme.dll 0x7fefc4c0000 0x7fefc515fff Memory Mapped File Readable, Writable, Executable False False False -
rsaenh.dll 0x7fefd190000 0x7fefd1d6fff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x7fefd490000 0x7fefd4a6fff Memory Mapped File Readable, Writable, Executable False False False -
wevtapi.dll 0x7fefd6c0000 0x7fefd72cfff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x7fefda60000 0x7fefda84fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x7fefda90000 0x7fefda9efff Memory Mapped File Readable, Writable, Executable False False False -
rpcrtremote.dll 0x7fefdb80000 0x7fefdb93fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x7fefde60000 0x7fefdecafff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x7fefdf70000 0x7fefe172fff Memory Mapped File Readable, Writable, Executable False False False -
clbcatq.dll 0x7fefef10000 0x7fefefa8fff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x7fefefb0000 0x7feff0dcfff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x7feff210000 0x7feff2aefff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x7feff2b0000 0x7feff38afff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x7feff390000 0x7feff3aefff Memory Mapped File Readable, Writable, Executable False False False -
lpk.dll 0x7feff3b0000 0x7feff3bdfff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x7feff3c0000 0x7feff3edfff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x7feff910000 0x7feff976fff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x7feff980000 0x7feff9f0fff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x7feffa00000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x7feffb10000 0x7feffbe6fff Memory Mapped File Readable, Writable, Executable False False False -
usp10.dll 0x7feffe90000 0x7fefff58fff Memory Mapped File Readable, Writable, Executable False False False -
apisetschema.dll 0x7fefff70000 0x7fefff70fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False -
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory Readable, Writable True False False -
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory Readable, Writable True False False -
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory Readable, Writable True False False -
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory Readable, Writable True False False -
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdcfff Private Memory Readable, Writable True False False -
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory Readable, Writable True False False -
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory Readable, Writable True False False -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image